Here is the complete, streamlined deployment guide for your Outline (Shadowsocks) server with Traefik integration.

### 1. Initial Preparation

Create your working directory, the data volume directory, and define your API prefix secret.

```bash
mkdir -p outline/data
cd outline
echo "SB_API_PREFIX=your_secure_random_string" > .env

```

*(Replace `your_secure_random_string` with a complex alphanumeric string).*

### 2. Generate API Certificates

The Outline Management API requires a self-signed certificate to initialize. Generate this directly into your data directory.

```bash
openssl req -x509 -nodes -days 36500 -newkey rsa:2048 \
  -subj "/CN=localhost" \
  -keyout ./data/shadowbox-selfsigned.key \
  -out ./data/shadowbox-selfsigned.crt

```

### 3. Create the Configuration

Create the `outline.yaml` file in your current directory.

```bash
nano outline.yaml

```

Paste the following configuration:

```yaml
services:
  shadowsocks:
    image: quay.io/outline/shadowbox:v1.12.3@sha256:545c6f7c7261bb30ae1dffe24a6fca5f8512f5d17c72cfb9e410e7e655444e62
    container_name: shadowsocks
    init: true
    expose:
      - 80
      - 443
    ports:
      - "127.0.0.1:8443:443/udp"
      - "127.0.0.1:30042:80/tcp"
    volumes:
      - ./data:/data:z
    environment:
      - SB_API_PORT=80
      - SB_STATE_DIR=/data
      - SB_CERTIFICATE_FILE=/data/shadowbox-selfsigned.crt
      - SB_PRIVATE_KEY_FILE=/data/shadowbox-selfsigned.key
      - SB_API_PREFIX=${SB_API_PREFIX}
    labels:
      - "traefik.enable=true"
      - "traefik.tcp.routers.shadowsocks.rule=HostSNI(`*`)"
      - "traefik.tcp.routers.shadowsocks.entrypoints=websecure"
      - "traefik.tcp.routers.shadowsocks.priority=1"
      - "traefik.tcp.services.shadowsocks.loadbalancer.server.port=443"
    healthcheck:
      test: ["CMD", "nc", "-z", "127.0.0.1", "80"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 10m
    restart: always
    networks:
      - traefik-public

networks:
  traefik-public:
    external: true

```

### 4. Deploy the Container

Initialize the service using Docker Compose.

```bash
docker compose -f outline.yaml up -d

```

### 5. Retrieve Connection Credentials

Extract the SHA-256 fingerprint of the certificate you generated in Step 2.

```bash
openssl x509 -in ./data/shadowbox-selfsigned.crt -noout -fingerprint -sha256 | sed 's/SHA256 Fingerprint=//' | tr -d ':'

```

### 6. Connect the Outline Manager

Construct the following JSON string using your environment variables and the fingerprint extracted above.

```json
{"apiUrl":"https://127.0.0.1:30042/your_secure_random_string","certSha256":"YOUR_EXTRACTED_FINGERPRINT"}

```

**To connect:**

1. Open an SSH tunnel on your local machine to securely access the API port:
```bash
ssh -L 30042:127.0.0.1:30042 vicfic@YOUR_VPS_IP

```


2. Open the Outline Manager application on your local machine.
3. Select **"Set up Outline anywhere"**.
4. Paste the constructed JSON string into the input field and connect.