oqyude/nixos
1
0
Fork 0
mirror of https://github.com/oqyude/nixos.git synced 2026-10-07 20:47:14 +03:00
Code Issues Packages Projects Releases Wiki Activity

vds: SNI-route TLS on 443 to Xray (15380→443) and 3x-ui panel (2049)

Browse Source 
nginx stream + ssl_preread reads the ClientHello SNI and forwards the
raw TCP stream (no TLS termination) to either:
  - 3x-ui panel on 127.0.0.1:2049 (SNI=pubray1.zeroq.su)
  - Xray on 127.0.0.1:15380 (SNI=pubrayx1.zeroq.su or default)

podman maps host:15380 → container:443 so Xray inside sees the client
on port 443 (matching its REALITY config) even though the host-side
port from podman's perspective is 15380. Host:2049 still maps to
container:2049 — 3x-ui now terminates TLS itself using the Let's
Encrypt cert mounted from /var/lib/acme/pubray1.zeroq.su/.

x-ui.db: webCertFile, webKeyFile and webDomain set so the panel
answers HTTPS on 2049. nginx no longer owns a server block on 443 —
only an ACME-only vhost for cert renewal.

REALITY inbound on container:443 still needs to be created via the
panel UI (the xrayTemplateConfig doesn't have it yet). The host-side
and routing plumbing is ready for it.
This commit is contained in:
oqyude
2026-08-28 00:36:54 +03:00
parent 0c2b45ea6f
commit 26e53e96bd
2 changed files with 69 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/containers/3x-ui.nix
+14 -4
View File
@@ -30,21 +30,31 @@ in
volumes = [
"${panel}/cert/:/root/cert:rw"
"${panel}/db/:/etc/x-ui:rw"
# Let's Encrypt cert for pubray1.zeroq.su — mounted read-only so
# 3x-ui can serve the panel over its own TLS (required for the
# nginx stream SNI-route on 443 → panel:2049 to work without
# HTTP termination at nginx). webCertFile / webKeyFile in the
# x-ui settings table must point at /root/cert/fullchain.pem
# and /root/cert/key.pem respectively.
"/var/lib/acme/pubray1.zeroq.su/fullchain.pem:/root/cert/fullchain.pem:ro"
"/var/lib/acme/pubray1.zeroq.su/key.pem:/root/cert/key.pem:ro"
];
log-driver = "journald";
# Port-forwarded networking (replaces --network=host).
# Bridges the same ports that were previously reachable while
# --network=host was set:
# 2049/tcp — 3x-ui web panel (reverse-proxied by nginx)
# 2049/tcp — 3x-ui web panel (TLS, SNI-routed from 443)
# 2096/tcp — subscription endpoint (reverse-proxied by nginx)
# 14380-15380/tcp+udp — Xray inbounds (matches firewall open range)
# 14380-15379/tcp+udp — Xray inbounds (matches firewall open range)
# 15380→443/tcp — Xray REALITY inbound (nginx stream on 443 → 15380)
# Adding a new inbound through the 3x-ui panel on a port outside
# this range will require extending this list and rebuilding.
ports = [
"0.0.0.0:2049:2049/tcp"
"0.0.0.0:2096:2096/tcp"
"0.0.0.0:14380-15380:14380-15380/tcp"
"0.0.0.0:14380-15380:14380-15380/udp"
"0.0.0.0:14380-15379:14380-15379/tcp"
"0.0.0.0:14380-15379:14380-15379/udp"
"0.0.0.0:15380:443/tcp"
];
};
};