From 26e53e96bdf54ab14121dcbd2c3c8adf7eb2d43c Mon Sep 17 00:00:00 2001 From: oqyude Date: Fri, 28 Aug 2026 00:34:32 +0300 Subject: [PATCH] =?UTF-8?q?vds:=20SNI-route=20TLS=20on=20443=20to=20Xray?= =?UTF-8?q?=20(15380=E2=86=92443)=20and=203x-ui=20panel=20(2049)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit nginx stream + ssl_preread reads the ClientHello SNI and forwards the raw TCP stream (no TLS termination) to either: - 3x-ui panel on 127.0.0.1:2049 (SNI=pubray1.zeroq.su) - Xray on 127.0.0.1:15380 (SNI=pubrayx1.zeroq.su or default) podman maps host:15380 → container:443 so Xray inside sees the client on port 443 (matching its REALITY config) even though the host-side port from podman's perspective is 15380. Host:2049 still maps to container:2049 — 3x-ui now terminates TLS itself using the Let's Encrypt cert mounted from /var/lib/acme/pubray1.zeroq.su/. x-ui.db: webCertFile, webKeyFile and webDomain set so the panel answers HTTPS on 2049. nginx no longer owns a server block on 443 — only an ACME-only vhost for cert renewal. REALITY inbound on container:443 still needs to be created via the panel UI (the xrayTemplateConfig doesn't have it yet). The host-side and routing plumbing is ready for it. --- modules/containers/3x-ui.nix | 18 +++++++-- modules/vds/nginx.nix | 75 ++++++++++++++++++++++++++---------- 2 files changed, 69 insertions(+), 24 deletions(-) diff --git a/modules/containers/3x-ui.nix b/modules/containers/3x-ui.nix index ac79c77..9fb4335 100644 --- a/modules/containers/3x-ui.nix +++ b/modules/containers/3x-ui.nix @@ -30,21 +30,31 @@ in volumes = [ "${panel}/cert/:/root/cert:rw" "${panel}/db/:/etc/x-ui:rw" + # Let's Encrypt cert for pubray1.zeroq.su — mounted read-only so + # 3x-ui can serve the panel over its own TLS (required for the + # nginx stream SNI-route on 443 → panel:2049 to work without + # HTTP termination at nginx). webCertFile / webKeyFile in the + # x-ui settings table must point at /root/cert/fullchain.pem + # and /root/cert/key.pem respectively. + "/var/lib/acme/pubray1.zeroq.su/fullchain.pem:/root/cert/fullchain.pem:ro" + "/var/lib/acme/pubray1.zeroq.su/key.pem:/root/cert/key.pem:ro" ]; log-driver = "journald"; # Port-forwarded networking (replaces --network=host). # Bridges the same ports that were previously reachable while # --network=host was set: - # 2049/tcp — 3x-ui web panel (reverse-proxied by nginx) + # 2049/tcp — 3x-ui web panel (TLS, SNI-routed from 443) # 2096/tcp — subscription endpoint (reverse-proxied by nginx) - # 14380-15380/tcp+udp — Xray inbounds (matches firewall open range) + # 14380-15379/tcp+udp — Xray inbounds (matches firewall open range) + # 15380→443/tcp — Xray REALITY inbound (nginx stream on 443 → 15380) # Adding a new inbound through the 3x-ui panel on a port outside # this range will require extending this list and rebuilding. ports = [ "0.0.0.0:2049:2049/tcp" "0.0.0.0:2096:2096/tcp" - "0.0.0.0:14380-15380:14380-15380/tcp" - "0.0.0.0:14380-15380:14380-15380/udp" + "0.0.0.0:14380-15379:14380-15379/tcp" + "0.0.0.0:14380-15379:14380-15379/udp" + "0.0.0.0:15380:443/tcp" ]; }; }; diff --git a/modules/vds/nginx.nix b/modules/vds/nginx.nix index cb8ee78..7610861 100644 --- a/modules/vds/nginx.nix +++ b/modules/vds/nginx.nix @@ -6,40 +6,75 @@ }: let server = "100.64.0.0"; + # TCP-level SNI routing on 443: + # pubray1.zeroq.su → 3x-ui panel (TLS passthrough to 127.0.0.1:2049, + # 3x-ui terminates TLS using the cert mounted + # from /var/lib/acme/pubray1.zeroq.su/) + # pubrayx1.zeroq.su → Xray REALITY (TLS passthrough to 127.0.0.1:15380, + # which podman DNATs to container:443) + # default → Xray (any other SNI / IP-direct hits the REALITY + # fallback, which is what we want) + # nginx stream does not inspect TLS — the SNI is read from the ClientHello + # via ssl_preread, then the entire TCP stream (including the rest of the + # TLS handshake) is forwarded as-is to the chosen upstream. So Xray sees + # the client connect on its real configured port (443) even though the + # host-side port from podman's perspective is 15380. + streamConfig = '' + stream { + ssl_preread on; + + map $ssl_preread_server_name $sni_backend { + default xray; + pubray1.zeroq.su panel; + pubrayx1.zeroq.su xray; + } + + upstream panel { + server 127.0.0.1:2049; + } + + upstream xray { + server 127.0.0.1:15380; + } + + server { + listen 443; + proxy_pass $sni_backend; + proxy_timeout 600s; + proxy_connect_timeout 5s; + } + } + ''; in { users.users.nginx.extraGroups = [ "acme" ]; services = { nginx = { enable = true; + # No virtualHosts..locations for /, /subs/, /subsjs/, /clash/ + # anymore — port 443 is now owned by the stream block, and the + # 3x-ui panel serves those paths itself once TLS is forwarded to it. + # Recommended HTTP options retained (still apply to the port-80 + # ACME server block). recommendedGzipSettings = true; recommendedOptimisation = true; recommendedProxySettings = true; recommendedTlsSettings = true; virtualHosts = { + # ACME only — nginx owns no HTTP server on 443 anymore. The + # cert at /var/lib/acme/pubray1.zeroq.su/ is consumed by the + # 3x-ui container (mounted into /root/cert/) so it can do its + # own TLS termination on 2049. Don't add forceSSL here: that + # would generate an HTTPS server block on 443 that conflicts + # with the stream listener above. "pubray1.zeroq.su" = { - forceSSL = true; enableACME = true; - locations = { - "/" = { - proxyPass = "http://localhost:2049"; - proxyWebsockets = true; - }; - "/subs/" = { - proxyPass = "http://localhost:2096"; - proxyWebsockets = true; - }; - "/subsjs/" = { - proxyPass = "http://localhost:2096"; - proxyWebsockets = true; - }; - "/clash/" = { - proxyPass = "http://localhost:2096"; - proxyWebsockets = true; - }; - }; }; }; + # Top-level nginx.conf snippet — `stream {}` lives outside `http {}`, + # so it can't go through virtualHosts / appendHttpConfig. The NixOS + # nginx module exposes appendConfig for this. + appendConfig = streamConfig; }; }; security.acme = { @@ -52,4 +87,4 @@ in 80 443 ]; -} +} \ No newline at end of file