vds: SNI-route TLS on 443 to Xray (15380→443) and 3x-ui panel (2049)

nginx stream + ssl_preread reads the ClientHello SNI and forwards the
raw TCP stream (no TLS termination) to either:
  - 3x-ui panel on 127.0.0.1:2049 (SNI=pubray1.zeroq.su)
  - Xray on 127.0.0.1:15380 (SNI=pubrayx1.zeroq.su or default)

podman maps host:15380 → container:443 so Xray inside sees the client
on port 443 (matching its REALITY config) even though the host-side
port from podman's perspective is 15380. Host:2049 still maps to
container:2049 — 3x-ui now terminates TLS itself using the Let's
Encrypt cert mounted from /var/lib/acme/pubray1.zeroq.su/.

x-ui.db: webCertFile, webKeyFile and webDomain set so the panel
answers HTTPS on 2049. nginx no longer owns a server block on 443 —
only an ACME-only vhost for cert renewal.

REALITY inbound on container:443 still needs to be created via the
panel UI (the xrayTemplateConfig doesn't have it yet). The host-side
and routing plumbing is ready for it.

modules/containers/3x-ui.nix

@@ -30,21 +30,31 @@ in
         volumes = [
           "${panel}/cert/:/root/cert:rw"
           "${panel}/db/:/etc/x-ui:rw"
+          # Let's Encrypt cert for pubray1.zeroq.su — mounted read-only so
+          # 3x-ui can serve the panel over its own TLS (required for the
+          # nginx stream SNI-route on 443 → panel:2049 to work without
+          # HTTP termination at nginx). webCertFile / webKeyFile in the
+          # x-ui settings table must point at /root/cert/fullchain.pem
+          # and /root/cert/key.pem respectively.
+          "/var/lib/acme/pubray1.zeroq.su/fullchain.pem:/root/cert/fullchain.pem:ro"
+          "/var/lib/acme/pubray1.zeroq.su/key.pem:/root/cert/key.pem:ro"
         ];
         log-driver = "journald";
         # Port-forwarded networking (replaces --network=host).
         # Bridges the same ports that were previously reachable while
         # --network=host was set:
-        #   2049/tcp            — 3x-ui web panel (reverse-proxied by nginx)
+        #   2049/tcp            — 3x-ui web panel (TLS, SNI-routed from 443)
         #   2096/tcp            — subscription endpoint (reverse-proxied by nginx)
-        #   14380-15380/tcp+udp — Xray inbounds (matches firewall open range)
+        #   14380-15379/tcp+udp — Xray inbounds (matches firewall open range)
+        #   15380→443/tcp       — Xray REALITY inbound (nginx stream on 443 → 15380)
         # Adding a new inbound through the 3x-ui panel on a port outside
         # this range will require extending this list and rebuilding.
         ports = [
           "0.0.0.0:2049:2049/tcp"
           "0.0.0.0:2096:2096/tcp"
-          "0.0.0.0:14380-15380:14380-15380/tcp"
+          "0.0.0.0:14380-15379:14380-15379/tcp"
-          "0.0.0.0:14380-15380:14380-15380/udp"
+          "0.0.0.0:14380-15379:14380-15379/udp"
+          "0.0.0.0:15380:443/tcp"
         ];
       };
     };

modules/vds/nginx.nix

@@ -6,40 +6,75 @@
 }:
 let
   server = "100.64.0.0";
+  # TCP-level SNI routing on 443:
+  #   pubray1.zeroq.su  → 3x-ui panel (TLS passthrough to 127.0.0.1:2049,
+  #                       3x-ui terminates TLS using the cert mounted
+  #                       from /var/lib/acme/pubray1.zeroq.su/)
+  #   pubrayx1.zeroq.su → Xray REALITY (TLS passthrough to 127.0.0.1:15380,
+  #                       which podman DNATs to container:443)
+  #   default           → Xray (any other SNI / IP-direct hits the REALITY
+  #                       fallback, which is what we want)
+  # nginx stream does not inspect TLS — the SNI is read from the ClientHello
+  # via ssl_preread, then the entire TCP stream (including the rest of the
+  # TLS handshake) is forwarded as-is to the chosen upstream. So Xray sees
+  # the client connect on its real configured port (443) even though the
+  # host-side port from podman's perspective is 15380.
+  streamConfig = ''
+    stream {
+        ssl_preread on;
+
+        map $ssl_preread_server_name $sni_backend {
+          default            xray;
+          pubray1.zeroq.su   panel;
+          pubrayx1.zeroq.su  xray;
+        }
+
+        upstream panel {
+          server 127.0.0.1:2049;
+        }
+
+        upstream xray {
+          server 127.0.0.1:15380;
+        }
+
+        server {
+          listen 443;
+          proxy_pass $sni_backend;
+          proxy_timeout 600s;
+          proxy_connect_timeout 5s;
+        }
+    }
+  '';
 in
 {
   users.users.nginx.extraGroups = [ "acme" ];
   services = {
     nginx = {
       enable = true;
+      # No virtualHosts.<name>.locations for /, /subs/, /subsjs/, /clash/
+      # anymore — port 443 is now owned by the stream block, and the
+      # 3x-ui panel serves those paths itself once TLS is forwarded to it.
+      # Recommended HTTP options retained (still apply to the port-80
+      # ACME server block).
       recommendedGzipSettings = true;
       recommendedOptimisation = true;
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
       virtualHosts = {
+        # ACME only — nginx owns no HTTP server on 443 anymore. The
+        # cert at /var/lib/acme/pubray1.zeroq.su/ is consumed by the
+        # 3x-ui container (mounted into /root/cert/) so it can do its
+        # own TLS termination on 2049. Don't add forceSSL here: that
+        # would generate an HTTPS server block on 443 that conflicts
+        # with the stream listener above.
         "pubray1.zeroq.su" = {
-          forceSSL = true;
           enableACME = true;
-          locations = {
-            "/" = {
-              proxyPass = "http://localhost:2049";
-              proxyWebsockets = true;
-            };
-            "/subs/" = {
-              proxyPass = "http://localhost:2096";
-              proxyWebsockets = true;
-            };
-            "/subsjs/" = {
-              proxyPass = "http://localhost:2096";
-              proxyWebsockets = true;
-            };
-            "/clash/" = {
-              proxyPass = "http://localhost:2096";
-              proxyWebsockets = true;
-            };
-          };
         };
       };
+      # Top-level nginx.conf snippet — `stream {}` lives outside `http {}`,
+      # so it can't go through virtualHosts / appendHttpConfig. The NixOS
+      # nginx module exposes appendConfig for this.
+      appendConfig = streamConfig;
     };
   };
   security.acme = {
@@ -52,4 +87,4 @@ in
     80
     443
   ];
-}
+}