The 3x-ui container config was hardcoded for vds: it mounted the LE
cert for pubray1.zeroq.su and published host:15380→container:443 for
Xray REALITY. The server imports the same module but for x.zeroq.su
(no REALITY inbound, no cert needed by 3x-ui itself yet).
Add two options so each device picks what it needs:
- xlib.services.3x-ui.certDomain: domain whose LE cert is mounted
at /root/cert/{fullchain,key}.pem. null means no cert mount.
- xlib.services.3x-ui.reality443Forwarding: when true, also publish
host:15380→container:443 for nginx stream SNI-routed REALITY.
vds sets both. Server sets only certDomain (kept harmless; nginx
still terminates TLS for x.zeroq.su, so the mounted cert is unused
until/unless 3x-ui is reconfigured to terminate TLS itself).
oqyude