Ask for the TLS fallback target in setup (default 127.0.0.1:8081)

The TLSFallbackDest override could only be set by hand-editing config.json, and
a re-run of setup never captured it. Setup now prompts for the masquerade target
whenever TLS mode is chosen (both DuckDNS and bring-your-own-domain), offering
127.0.0.1:8081 by default; Enter keeps it, another host:port changes it, and
'no' falls back to the built-in decoy site. The choice persists across re-runs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: icecube092

src/internal/commands/commands_test.go

@@ -28,6 +28,38 @@ func TestAskProtocolPortKeepsSavedPort(t *testing.T) {
 	}
 }
 
+func TestAskTLSFallback(t *testing.T) {
+	noop := func() {}
+
+	// Enter on a fresh config accepts the offered default (127.0.0.1:8081).
+	c := &config.AppConfig{}
+	askTLSFallback(newInputFrom(strings.NewReader("\n")), c, noop)
+	if c.TLSFallbackDest != defaultTLSFallbackDest {
+		t.Errorf("Enter = %q, want default %q", c.TLSFallbackDest, defaultTLSFallbackDest)
+	}
+
+	// A typed host:port overrides it.
+	c = &config.AppConfig{}
+	askTLSFallback(newInputFrom(strings.NewReader("127.0.0.1:9000\n")), c, noop)
+	if c.TLSFallbackDest != "127.0.0.1:9000" {
+		t.Errorf("typed value = %q, want 127.0.0.1:9000", c.TLSFallbackDest)
+	}
+
+	// 'no' clears it back to the built-in site (empty).
+	c = &config.AppConfig{TLSFallbackDest: "127.0.0.1:8081"}
+	askTLSFallback(newInputFrom(strings.NewReader("no\n")), c, noop)
+	if c.TLSFallbackDest != "" {
+		t.Errorf("'no' = %q, want empty (built-in site)", c.TLSFallbackDest)
+	}
+
+	// A value without a port is rejected and falls back to the built-in site.
+	c = &config.AppConfig{}
+	askTLSFallback(newInputFrom(strings.NewReader("example.com\n")), c, noop)
+	if c.TLSFallbackDest != "" {
+		t.Errorf("no-port value = %q, want empty", c.TLSFallbackDest)
+	}
+}
+
 func TestCheckInbounds(t *testing.T) {
 	// Without a config: only the default VLESS port is reported (public == bind).
 	got := checkInbounds(config.AppConfig{}, false)

src/internal/commands/setup.go

@@ -517,21 +517,20 @@ func configureCamouflage(r *input, c *config.AppConfig, save func()) error {
 	mode := strings.ToLower(strings.TrimSpace(ask(r, "Camouflage mode (reality/tls)", def)))
 
 	if mode == config.CamouflageTLSMode {
-		switch {
-		case c.DuckDNSHost() != "":
+		if c.DuckDNSHost() == "" && c.CustomDomain == "" {
+			fmt.Println("  ! TLS mode needs a domain — either DuckDNS (token + subdomain) or")
+			fmt.Println("    your own domain — but none is configured. Using REALITY.")
+		} else {
 			c.Camouflage = config.CamouflageTLSMode
 			save()
-			return configureTLS(r, c, save)
-		case c.CustomDomain != "":
+			askTLSFallback(r, c, save)
+			if c.DuckDNSHost() != "" {
+				return configureTLS(r, c, save)
+			}
 			// Bring-your-own domain: the node can't run the DNS-01 challenge
 			// without DuckDNS, so the operator provides the certificate.
-			c.Camouflage = config.CamouflageTLSMode
-			save()
 			configureTLSManual(r, c)
 			return nil
-		default:
-			fmt.Println("  ! TLS mode needs a domain — either DuckDNS (token + subdomain) or")
-			fmt.Println("    your own domain — but none is configured. Using REALITY.")
 		}
 	}
 
@@ -561,6 +560,34 @@ func configureCamouflage(r *input, c *config.AppConfig, save func()) error {
 	return nil
 }
 
+// defaultTLSFallbackDest is offered in setup as the masquerade target: the
+// plain-HTTP vhost operators commonly run to front a real site behind the node
+// (see the 443-sharing deploy). Enter accepts it; 'no' keeps the built-in site.
+const defaultTLSFallbackDest = "127.0.0.1:8081"
+
+// askTLSFallback asks where non-proxy TLS traffic (browsers, active probes) is
+// sent — the masquerade target xray falls back to. It offers 127.0.0.1:8081 by
+// default (a local reverse proxy fronting a real site); Enter keeps it, another
+// host:port changes it, and 'no' uses the node's built-in decoy website (stored
+// as an empty TLSFallbackDest). Persisted so a re-run of setup keeps the choice
+// instead of forcing re-entry.
+func askTLSFallback(r *input, c *config.AppConfig, save func()) {
+	fmt.Println("\nTLS fallback target — where non-proxy visitors (and probes) land.")
+	fmt.Println("  Default 127.0.0.1:8081 fronts your own site (e.g. a local reverse proxy);")
+	fmt.Println("  enter a different host:port to change it, or 'no' for the built-in decoy site.")
+	def := c.TLSFallbackDest
+	if def == "" {
+		def = defaultTLSFallbackDest
+	}
+	v := askClearable(r, "  Fallback target (host:port; 'no' = built-in site)", def)
+	if v != "" && !strings.Contains(v, ":") {
+		fmt.Printf("  ! expected host:port (e.g. %s) — using the built-in site\n", defaultTLSFallbackDest)
+		v = ""
+	}
+	c.TLSFallbackDest = v
+	save()
+}
+
 // leAgreementURL is the Let's Encrypt Subscriber Agreement shown before we
 // register an ACME account on the operator's behalf.
 const leAgreementURL = "https://letsencrypt.org/repository/"