A runbook you can hand directly to Claude Code to execute. Covers sing-box multi-protocol deployment (VLESS-Reality / Hysteria2 / TUIC-v5), SSL certificates via Cloudflare DNS API, nginx subscription server with dynamic traffic stats, and Clash Verge / Shadowrocket client configuration. Replace the placeholders, hand it to your agent, hit go.

After years of commercial VPN services, I decided to self-host. One afternoon, one VPS, Claude Code doing all the work. Shadowsocks got blocked within hours, the cert saga had three false starts, but what came out the other side was more complete than I expected.