sing-box

sing-box tunnels your internet traffic through encrypted proxies, and it speaks basically every protocol in the space: Shadowsocks, VMess, VLESS, Trojan, Hysteria2, WireGuard, and more. It replaced a pile of separate tools as the engine behind most modern proxy clients, and the whole thing is free under GPL v3, including the official iOS and Android apps.

Self-hosting is light on resources and heavy on configuration. The single Go binary runs anywhere (Linux, macOS, Windows, routers) and sips memory, but everything is driven by a JSON config of inbounds, outbounds, and routing rules. The docs are reference-style: accurate, complete, and not gentle. Budget an evening for your first working setup.

Solo: this is the standard for self-hosted proxy infrastructure, use it. Small teams running their own private network access: solid, paired with the official clients. Companies that want managed device access should look at a mesh VPN like juanfont/headscale instead; sing-box is a proxy platform, not a device management plane.

The catch: the config format changes between major versions and migration is on you. And depending on your country and your network's policies, running proxy infrastructure can carry real legal risk. Know the rules before you deploy.