diff --git a/modules/containers/3x-ui.nix b/modules/containers/3x-ui.nix
index fe28152..f071414 100644
--- a/modules/containers/3x-ui.nix
+++ b/modules/containers/3x-ui.nix
@@ -25,8 +25,12 @@ let
     # 14380-15379/tcp+udp — Xray inbounds (matches firewall open range)
     "0.0.0.0:2049:2049/tcp"
     "0.0.0.0:2096:2096/tcp"
-    "0.0.0.0:14380-15379:14380-15379/tcp"
-    "0.0.0.0:14380-15379:14380-15379/udp"
+    "0.0.0.0:8443:8443/tcp"
+    "0.0.0.0:8443:8443/udp"
+    "0.0.0.0:18443:18443/tcp"
+    "0.0.0.0:18443:18443/udp"
+    # "0.0.0.0:14380-15379:14380-15379/tcp"
+    # "0.0.0.0:14380-15379:14380-15379/udp"
   ];
   # VDS-only: nginx stream forwards host:443 → host:15380 → container:443,
   # so Xray inside the container sees its REALITY inbound on its real
@@ -113,17 +117,25 @@ in
 
   # Enable container name DNS for all Podman networks.
   networking.firewall = {
-    allowedUDPPortRanges = [
-      {
-        from = 14380;
-        to = 15380;
-      }
+    # allowedUDPPortRanges = [
+    #   {
+    #     from = 8443;
+    #     to = 15380;
+    #   }
+    # ];
+    # allowedTCPPortRanges = [
+    #   {
+    #     from = 14380;
+    #     to = 15380;
+    #   }
+    # ];
+    allowedUDPPorts = [
+      18443
+      8443
     ];
-    allowedTCPPortRanges = [
-      {
-        from = 14380;
-        to = 15380;
-      }
+    allowedTCPPorts = [
+      18443
+      8443
     ];
     interfaces =
       let
diff --git a/modules/vds/systemd.nix b/modules/vds/systemd.nix
index 9ea2285..bce0089 100644
--- a/modules/vds/systemd.nix
+++ b/modules/vds/systemd.nix
@@ -19,7 +19,7 @@ in
         unitConfig.RequiresMountsFor = [ ];
         after = [ "network-online.target" ];
         wants = [ "network-online.target" ];
-        wantedBy = [ "multi-user.target" ];
+        # Только по таймеру: НЕ блокируем boot и активацию nixos-rebuild.
         script = ''
           set -euo pipefail
 
@@ -29,31 +29,21 @@ in
           SSH_CMD="$SSH \
             -o BatchMode=yes \
             -o ConnectTimeout=5 \
+            -o ServerAliveInterval=5 \
+            -o ServerAliveCountMax=3 \
             -o StrictHostKeyChecking=no"
 
-          echo "Waiting for server..."
-
-          for i in $(seq 1 60); do
-            echo "Attempt $i"
-
-            if $SSH_CMD ${serverAddress} true >/dev/null 2>&1; then
-              echo "Server available"
-              break
-            fi
-
-            sleep 5
-          done
-
-          # final check
-          $SSH_CMD ${serverAddress} true >/dev/null 2>&1
-
           mkdir -p "${nodeDir}"
 
+          # best-effort: сервер недоступен -> выходим сразу, никаких циклов ожидания
+          if ! $SSH_CMD ${serverAddress} true >/dev/null 2>&1; then
+            echo "Server ${serverAddress} unreachable, skipping sync"
+            exit 0
+          fi
+
           if [ ! -d "${nodeDir}" ] || [ -z "$(ls -A "${nodeDir}")" ]; then
             echo "Pull <- ${serverAddress}"
 
-            mkdir -p "${nodeDir}"
-
             $RSYNC \
               -e "$SSH_CMD" \
               -a \
@@ -77,6 +67,9 @@ in
           Nice = 10;
           CPUQuota = "5%";
           IOSchedulingClass = "idle";
+          # страховка от зависшего rsync/ssh; легитимная большая синхронизация
+          # укладывается в это окно (на фоне idle-приоритета)
+          TimeoutStartSec = 600;
         };
       };
     };