diff --git a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/defaults/main.yml b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/defaults/main.yml
new file mode 100644
index 00000000..856b5d7a
--- /dev/null
+++ b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/defaults/main.yml
@@ -0,0 +1,6 @@
+xray_main_port: 1443
+xray_tproxy_port: 51830
+xray_cert_path: "/etc/ssl/onwalk.net.pem"
+xray_key_path: "/etc/ssl/onwalk.net.key"
+xray_bin_path: /usr/local/bin/xray
+xray_config_dir: /usr/local/etc/xray
diff --git a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/handlers/main.yml b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/handlers/main.yml
new file mode 100644
index 00000000..22b182b3
--- /dev/null
+++ b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/handlers/main.yml
@@ -0,0 +1,12 @@
+---
+- name: Restart xray service
+  systemd:
+    name: xray.service
+    state: restarted
+    enabled: yes
+
+- name: Restart xray-tproxy service
+  systemd:
+    name: xray-tproxy.service
+    state: restarted
+    enabled: yes
diff --git a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/tasks/main.yml b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/tasks/main.yml
new file mode 100644
index 00000000..79ea2d16
--- /dev/null
+++ b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/tasks/main.yml
@@ -0,0 +1,60 @@
+---
+- name: Load overlay config from file
+  set_fact:
+    overlay_config: "{{ lookup('file', overlay_config_path) | from_yaml }}"
+
+- name: Extract Xray variables for this node
+  set_fact:
+    xray_uuid: "{{ overlay_config.nodes[inventory_hostname].xray.uuid }}"
+    xray_remote_domain: "{{ overlay_config.nodes[inventory_hostname].xray.remote_domain }}"
+    xray_cert_path: "{{ overlay_config.nodes[inventory_hostname].xray.cert_path }}"
+    xray_key_path: "{{ overlay_config.nodes[inventory_hostname].xray.key_path }}"
+
+- name: Install Xray using official script
+  shell: |
+    bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)"
+  args:
+    creates: /usr/local/bin/xray
+  notify:
+    - Restart xray service
+    - Restart xray-tproxy service
+
+- name: Ensure required directories exist
+  file:
+    path: "{{ item }}"
+    state: directory
+    mode: '0755'
+  loop:
+    - "{{ xray_bin_path | dirname }}"
+    - "{{ xray_config_dir }}"
+
+- name: Deploy Xray config templates
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: '0644'
+  loop:
+    - { src: "config.json.j2", dest: "{{ xray_config_dir }}/config.json" }
+    - { src: "tproxy-config.json.j2", dest: "{{ xray_config_dir }}/tproxy-config.json" }
+
+- name: Deploy systemd service templates
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: '0644'
+  loop:
+    - { src: "xray.service.j2", dest: "/etc/systemd/system/xray.service" }
+    - { src: "xray-tproxy.service.j2", dest: "/etc/systemd/system/xray-tproxy.service" }
+
+- name: Reload systemd
+  systemd:
+    daemon_reload: yes
+
+- name: Enable and start xray services
+  systemd:
+    name: "{{ item }}"
+    enabled: yes
+    state: started
+  loop:
+    - xray.service
+    - xray-tproxy.service
diff --git a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/config.json.j2 b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/config.json.j2
new file mode 100644
index 00000000..c724a906
--- /dev/null
+++ b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/config.json.j2
@@ -0,0 +1,76 @@
+{
+  "log": {
+    "loglevel": "error"
+  },
+  "routing": {
+    "domainStrategy": "IPIfNonMatch",
+    "rules": [
+      {
+        "type": "field",
+        "ip": [
+          "geoip:cn"
+        ],
+        "outboundTag": "block"
+      }
+    ]
+  },
+  "inbounds": [
+    {
+      "listen": "0.0.0.0",
+      "port": {{ xray_main_port }},
+      "protocol": "vless",
+      "settings": {
+        "clients": [
+          {
+            "id": "{{ xray_uuid }}",
+            "flow": "xtls-rprx-vision"
+          }
+        ],
+        "decryption": "none",
+        "fallbacks": [
+          {
+            "dest": 8001,
+            "xver": 1
+          },
+          {
+            "alpn": "h2",
+            "dest": 8002,
+            "xver": 1
+          }
+        ]
+      },
+      "streamSettings": {
+        "network": "tcp",
+        "security": "tls",
+        "tlsSettings": {
+          "rejectUnknownSni": true,
+          "minVersion": "1.2",
+          "certificates": [
+            {
+              "ocspStapling": 3600,
+              "certificateFile": "{{ xray_cert_path }}",
+              "keyFile": "{{ xray_key_path }}"
+            }
+          ]
+        }
+      },
+      "sniffing": {
+        "enabled": true,
+        "destOverride": ["http", "tls"]
+      }
+    }
+  ],
+  "outbounds": [
+    {
+      "protocol": "freedom"
+    }
+  ],
+  "policy": {
+    "levels": {
+      "0": {
+        "handshake": 2,
+        "connIdle": 120
+      }
+    }
+  }
+}
diff --git a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/tproxy-config.json.j2 b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/tproxy-config.json.j2
new file mode 100644
index 00000000..c920ee46
--- /dev/null
+++ b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/tproxy-config.json.j2
@@ -0,0 +1,59 @@
+{
+  "log": {
+    "loglevel": "info"
+  },
+  "routing": {
+    "domainStrategy": "IPIfNonMatch",
+    "rules": []
+  },
+  "inbounds": [
+    {
+      "listen": "127.0.0.1",
+      "port": {{ xray_tproxy_port }},
+      "protocol": "dokodemo-door",
+      "settings": {
+        "address": "{{ xray_remote_domain }}",
+        "port": {{ xray_main_port }},
+        "network": "udp"
+      }
+    }
+  ],
+  "outbounds": [
+    {
+      "protocol": "vless",
+      "settings": {
+        "vnext": [
+          {
+            "address": "{{ xray_remote_domain }}",
+            "port": {{ xray_main_port }},
+            "users": [
+              {
+                "id": "{{ xray_uuid }}",
+                "encryption": "none",
+                "flow": "xtls-rprx-vision"
+              }
+            ]
+          }
+        ]
+      },
+      "streamSettings": {
+        "network": "tcp",
+        "security": "tls",
+        "tlsSettings": {
+          "serverName": "{{ xray_remote_domain }}",
+          "allowInsecure": false,
+          "fingerprint": "chrome"
+        }
+      },
+      "tag": "proxy"
+    },
+    {
+      "protocol": "freedom",
+      "tag": "direct"
+    },
+    {
+      "protocol": "blackhole",
+      "tag": "block"
+    }
+  ]
+}
diff --git a/ansible/playbooks/vpn-xray-hub.yaml b/ansible/playbooks/vpn-xray-hub.yaml
new file mode 100644
index 00000000..e1d8820d
--- /dev/null
+++ b/ansible/playbooks/vpn-xray-hub.yaml
@@ -0,0 +1,8 @@
+- name: Setup Xray for hub
+  hosts: all
+  become: true
+  vars:
+    overlay_config_path: "{{ playbook_dir }}/../../config/sit/vpn-overlay.yaml"
+    overlay_keys_path: "{{ playbook_dir }}/../../config/sit/vpn-keys.yaml"
+  roles:
+    - role: vhosts/vpn-overlay/xray/hub
diff --git a/config/sit/vpn-overlay.yaml b/config/sit/vpn-overlay.yaml
index c78c8fa9..4cae9010 100644
--- a/config/sit/vpn-overlay.yaml
+++ b/config/sit/vpn-overlay.yaml
@@ -14,15 +14,23 @@ features:
 
 # WireGuard Hub 节点配置
 hubs:
-  - name: hub-1
+  - name: cn-hub
     wg_ip: 172.16.0.1
     br_ip: 10.253.253.1
-    public_ip: global-proxy.onwalk.net
+    public_ip: cn-proxy.onwalk.net
+    uuid: ""
+    remote_domain: "global-proxy.onwalk.net"
+    cert_path: "/etc/ssl/onwalk.net.pem"
+    key_path: "/etc/ssl/onwalk.net.key"
 
-  - name: hub2
+  - name: global-hub
     wg_ip: 10.100.1.1
     br_ip: 172.16.1.1
     public_ip: hub2.example.com
+    uuid: ""
+    remote_domain: "global-proxy.onwalk.net"
+    cert_path: "/etc/ssl/onwalk.net.pem"
+    key_path: "/etc/ssl/onwalk.net.key"
 
 # 各个站点定义
 sites: