10000 entries in serverNames, and possibly two million more in next weeks - will this be a problem?

[Kenya-West]

My Ansible generates all possible combinations of domains used in XRay servers. This is increased as factorial of N×M×100, where N - root domains, M - subdomains, and 100 is variations of M, like M-1.N.tld, and so on.

If I buy few new domains, it will generate a million of combinations will be produced, at least.

Will this be a problem for XRay-Core with typical VPS setup, like 1 vCPU (5-10%)/2 GB of RAM/10 GB of storage?

[kamilkaczmareksolutions]

the lookup itself is fine, the startup probing is what will hurt you

• matching is a plain Go map: serverNames becomes map[string]bool (reality/config.go) and REALITY checks config.ServerNames[hs.clientHello.serverName] per handshake (tls.go), so cost per connection doesn't grow with the list. exact match only, no wildcards
• memory: i ran a quick Go 1.27 test with 1M names like m-37.sub12.example-domain.com: about 48 MB for the strings plus 56 MB for the map, roughly double for 2M. Xray also holds the JSON and protobuf copies while loading, so plan for a few hundred MB at start on 2 GB, tight but not a crash by itself

the real problem: when a REALITY RAW inbound starts, Xray runs DetectPostHandshakeRecordsLens (tcp/hub.go), which loops over every server name × 3 ALPN variants and spawns 2 goroutines each that dial your target and do a full TLS handshake (record_detect.go), with no concurrency limit. that's 60k handshakes for 10k names and 6M for 1M, all fired at once on every start or restart. on 1 vCPU you'll hit file descriptor limits and CPU saturation, and the target site will see it as a flood from your IP

so 10k is already heavy, 1M+ isn't realistic. serverNames only has to contain the SNIs your clients actually send, and each has to be one the target really serves, so a small fixed set per inbound is the usual setup. if you rotate domains, generate only the names in use and reload, instead of all combinations

[Kenya-West]

Wow, thanks for much detailed information!

if you rotate domains, generate only the names in use and reload, instead of all combinations

That's what I will do, thanks. Since both the possible combinations and the final "live" domain list are composed by Ansible, I will remove combinations and switch to live SNI that exist in runtime.

Thanks, again!