diff --git a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/tasks/main.yml b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/tasks/main.yml
index 79ea2d16..02f4259e 100644
--- a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/tasks/main.yml
+++ b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/tasks/main.yml
@@ -3,12 +3,26 @@
   set_fact:
     overlay_config: "{{ lookup('file', overlay_config_path) | from_yaml }}"
 
-- name: Extract Xray variables for this node
+- name: Convert overlay_config.hubs list to dict (hubs_map)
   set_fact:
-    xray_uuid: "{{ overlay_config.nodes[inventory_hostname].xray.uuid }}"
-    xray_remote_domain: "{{ overlay_config.nodes[inventory_hostname].xray.remote_domain }}"
-    xray_cert_path: "{{ overlay_config.nodes[inventory_hostname].xray.cert_path }}"
-    xray_key_path: "{{ overlay_config.nodes[inventory_hostname].xray.key_path }}"
+    hubs_map: "{{ dict(overlay_config.hubs | map(attribute='name') | zip(overlay_config.hubs)) }}"
+  when: overlay_config.hubs is defined
+
+- name: Convert overlay_config.sites list to dict (sites_map)
+  set_fact:
+    sites_map: "{{ dict(overlay_config.sites | map(attribute='name') | zip(overlay_config.sites)) }}"
+  when: overlay_config.sites is defined
+
+- name: 显示主机名
+  debug:
+    var: overlay_config
+  when: debug | default(false)
+
+- set_fact:
+    xray_uuid: "{{ hubs_map[inventory_hostname].xray.uuid }}"
+    xray_remote_domain: "{{ hubs_map[inventory_hostname].xray.remote_domain }}"
+    xray_cert_path: "{{ hubs_map[inventory_hostname].xray.cert_path }}"
+    xray_key_path: "{{ hubs_map[inventory_hostname].xray.key_path }}"
 
 - name: Install Xray using official script
   shell: |
diff --git a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/config.json.j2 b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/config.json.j2
index c724a906..6a68ea43 100644
--- a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/config.json.j2
+++ b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/config.json.j2
@@ -3,16 +3,7 @@
     "loglevel": "error"
   },
   "routing": {
-    "domainStrategy": "IPIfNonMatch",
-    "rules": [
-      {
-        "type": "field",
-        "ip": [
-          "geoip:cn"
-        ],
-        "outboundTag": "block"
-      }
-    ]
+    "rules": []
   },
   "inbounds": [
     {
@@ -43,8 +34,8 @@
         "network": "tcp",
         "security": "tls",
         "tlsSettings": {
-          "rejectUnknownSni": true,
           "minVersion": "1.2",
+          "rejectUnknownSni": true,
           "certificates": [
             {
               "ocspStapling": 3600,
@@ -56,7 +47,10 @@
       },
       "sniffing": {
         "enabled": true,
-        "destOverride": ["http", "tls"]
+        "destOverride": [
+          "http",
+          "tls"
+        ]
       }
     }
   ],
diff --git a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/tproxy-config.json.j2 b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/tproxy-config.json.j2
index c920ee46..bd66f765 100644
--- a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/tproxy-config.json.j2
+++ b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/tproxy-config.json.j2
@@ -3,17 +3,16 @@
     "loglevel": "info"
   },
   "routing": {
-    "domainStrategy": "IPIfNonMatch",
     "rules": []
   },
   "inbounds": [
     {
       "listen": "127.0.0.1",
-      "port": {{ xray_tproxy_port }},
+      "port": 51830,
       "protocol": "dokodemo-door",
       "settings": {
-        "address": "{{ xray_remote_domain }}",
-        "port": {{ xray_main_port }},
+        "address": "{{ hubs_map[inventory_hostname].xray.relay_address }}",
+        "port": {{ hubs_map[inventory_hostname].xray.relay_port }},
         "network": "udp"
       }
     }
@@ -24,11 +23,11 @@
       "settings": {
         "vnext": [
           {
-            "address": "{{ xray_remote_domain }}",
-            "port": {{ xray_main_port }},
+            "address": "{{ hubs_map[inventory_hostname].xray.relay_address }}",
+            "port": 1443,
             "users": [
               {
-                "id": "{{ xray_uuid }}",
+                "id": "{{ hubs_map[inventory_hostname].xray.uuid }}",
                 "encryption": "none",
                 "flow": "xtls-rprx-vision"
               }
@@ -40,7 +39,7 @@
         "network": "tcp",
         "security": "tls",
         "tlsSettings": {
-          "serverName": "{{ xray_remote_domain }}",
+          "serverName": "{{ hubs_map[inventory_hostname].xray.remote_domain }}",
           "allowInsecure": false,
           "fingerprint": "chrome"
         }
diff --git a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/xray-tproxy.service.j2 b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/xray-tproxy.service.j2
new file mode 100644
index 00000000..f440158d
--- /dev/null
+++ b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/xray-tproxy.service.j2
@@ -0,0 +1,18 @@
+[Unit]
+Description=Xray Tproxy Service
+Documentation=https://github.com/xtls
+After=network.target nss-lookup.target
+
+[Service]
+User=nobody
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+NoNewPrivileges=true
+ExecStart=/usr/local/bin/xray run -config /usr/local/etc/xray/tproxy-config.json
+Restart=on-failure
+RestartPreventExitStatus=23
+LimitNPROC=10000
+LimitNOFILE=1000000
+
+[Install]
+WantedBy=multi-user.target
diff --git a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/xray.service.j2 b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/xray.service.j2
new file mode 100644
index 00000000..978fbbdc
--- /dev/null
+++ b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/xray.service.j2
@@ -0,0 +1,18 @@
+[Unit]
+Description=Xray Service
+Documentation=https://github.com/xtls
+After=network.target nss-lookup.target
+
+[Service]
+User=nobody
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+NoNewPrivileges=true
+ExecStart=/usr/local/bin/xray run -config /usr/local/etc/xray/config.json
+Restart=on-failure
+RestartPreventExitStatus=23
+LimitNPROC=10000
+LimitNOFILE=1000000
+
+[Install]
+WantedBy=multi-user.target
diff --git a/config/sit/vpn-overlay.yaml b/config/sit/vpn-overlay.yaml
index 6c8fd11b..416507b6 100644
--- a/config/sit/vpn-overlay.yaml
+++ b/config/sit/vpn-overlay.yaml
@@ -20,10 +20,13 @@ hubs:
     br_ip: 10.253.253.1
     local_ip: 172.30.0.1
     remote_ip: 172.31.0.1
-    uuid: ""
-    remote_domain: "global-proxy.onwalk.net"
-    cert_path: "/etc/ssl/onwalk.net.pem"
-    key_path: "/etc/ssl/onwalk.net.key"
+    xray:
+      uuid: "18d270a9-533d-4b13-b3f1-e7f55540a9b2"
+      relay_address: "global-proxy.onwalk.net"
+      relay_port: '51820'
+      remote_domain: "global-proxy.onwalk.net"
+      cert_path: "/etc/ssl/onwalk.net.pem"
+      key_path: "/etc/ssl/onwalk.net.key"
     wireguard_peer:
       - master-1
       - slave-1 
@@ -36,7 +39,13 @@ hubs:
     br_ip: 10.253.253.2
     local_ip: 172.31.0.1
     remote_ip: 172.30.0.1
-    public_ip: hub2.example.com
+    xray:
+      uuid: "18d270a9-533d-4b13-b3f1-e7f55540a9b2"
+      cert_path: "/etc/ssl/onwalk.net.pem"
+      key_path: "/etc/ssl/onwalk.net.key"
+      relay_address: "cn-proxy.onwalk.net"
+      relay_port: '51820'
+      remote_domain: "cn-proxy.onwalk.net"
     wireguard_peer:
       - master-1
       - slave-1