Xray-install

# Xray-install

English | [简体中文](README_zh-Hans.md) | [繁體中文](README_zh-Hant.md)

Bash script for installing Xray in operating systems such as CentOS / Debian / OpenSUSE that support systemd.

**For Alpine or Gentoo Linux users**, please refer to **[OpenRC-specific instructions](alpinelinux/README.md)** for installation scripts and guides for Alpine/Gentoo Linux.

> [!WARNING]
>
> **Breaking changes since 2026-10-18**
>
> **Fresh installations can ignore this notice. When upgrading from older versions, follow these instructions to avoid Xray startup failures or reduced security.**
>
> 1. **Geodata**: To address some known issues, the data source has changed from Loyalsoldier/v2ray-rules-dat to [XTLS/Xray-rules-dat](https://github.com/XTLS/Xray-rules-dat). Full compatibility with the previous data is not guaranteed. If you need GeoIP country categories other than `cn`, `ru`, and `ir`, run `update-geodata` (renamed from `install-geodata`). If you need special GeoSite categories provided by Loyalsoldier, such as `gfw` or `win-spy`, manually download [Loyalsoldier's geosite.dat](https://github.com/Loyalsoldier/v2ray-rules-dat/releases/latest/download/geosite.dat), save it as `geosite-loyalsoldier.dat` in the asset directory, and use `ext:geosite-loyalsoldier.dat:category` in your Xray configuration.
> 2. **Log rotation**: Use the `--logrotate` option provided by this installer. Do not configure additional rotation tasks, as they may cause permission or log writing issues.
> 3. **File permissions**: In response to the recent wave of 0day vulnerabilities in other software and system components, this installer strengthens service isolation and file permission controls to limit their potential impact on Xray. Services now run under the dedicated `xray` user instead of the shared `nobody` user. Custom runtime users are no longer supported, and permissions on configuration and log directories have been tightened. Check access permissions for your custom configuration files, certificates, and existing installations.
>
>    <details>
>    <summary>Expand to view file permission requirements</summary>
>
>    The table below shows the secure default permissions automatically set by the current installer. The program and configuration are managed by `root`, and the `xray` user can only read the configuration; the service can write assets and logs. These settings protect logs and configuration files and follow security best practices.
>
>    | Purpose                 | Path                                | Owner:Group | Permissions |
>    | ----------------------- | ----------------------------------- | ----------- | ----------- |
>    | Xray binary             | `/usr/local/bin/xray`               | `root:root` | `0755`      |
>    | Configuration directory | `/usr/local/etc/xray/`              | `root:xray` | `0750`      |
>    | Configuration files     | `/usr/local/etc/xray/*.json`        | `root:xray` | `0640`      |
>    | Asset directory         | `/usr/lo