vds: drop pubrayx1.zeroq.su from SNI map — Xray now served under pubray1

All Xray REALITY clients already connect to VDS_IP via
pubray1.zeroq.su (or any of its subdomains). Removing the explicit
pubrayx1.zeroq.su → xray rule means the default route catches it.
This way we only have to publish one domain (pubray1.zeroq.su)
in subscriptions instead of two.

Companion change in x-ui.db (separate runbook step): subURI set
to https://pubray1.zeroq.su/subs/ so regenerated subscriptions
emit URLs under pubray1.zeroq.su, not x.zeroq.su.

modules/containers/3x-ui.nix

@@ -30,10 +30,31 @@ in
         volumes = [
           "${panel}/cert/:/root/cert:rw"
           "${panel}/db/:/etc/x-ui:rw"
+          # Let's Encrypt cert for pubray1.zeroq.su — mounted read-only so
+          # 3x-ui can serve the panel over its own TLS (required for the
+          # nginx stream SNI-route on 443 → panel:2049 to work without
+          # HTTP termination at nginx). webCertFile / webKeyFile in the
+          # x-ui settings table must point at /root/cert/fullchain.pem
+          # and /root/cert/key.pem respectively.
+          "/var/lib/acme/pubray1.zeroq.su/fullchain.pem:/root/cert/fullchain.pem:ro"
+          "/var/lib/acme/pubray1.zeroq.su/key.pem:/root/cert/key.pem:ro"
         ];
         log-driver = "journald";
-        extraOptions = [
-          "--network=host"
+        # Port-forwarded networking (replaces --network=host).
+        # Bridges the same ports that were previously reachable while
+        # --network=host was set:
+        #   2049/tcp            — 3x-ui web panel (TLS, SNI-routed from 443)
+        #   2096/tcp            — subscription endpoint (reverse-proxied by nginx)
+        #   14380-15379/tcp+udp — Xray inbounds (matches firewall open range)
+        #   15380→443/tcp       — Xray REALITY inbound (nginx stream on 443 → 15380)
+        # Adding a new inbound through the 3x-ui panel on a port outside
+        # this range will require extending this list and rebuilding.
+        ports = [
+          "0.0.0.0:2049:2049/tcp"
+          "0.0.0.0:2096:2096/tcp"
+          "0.0.0.0:14380-15379:14380-15379/tcp"
+          "0.0.0.0:14380-15379:14380-15379/udp"
+          "0.0.0.0:15380:443/tcp"
         ];
       };
     };

modules/vds/nginx.nix

@@ -6,40 +6,80 @@
 }:
 let
   server = "100.64.0.0";
+  # TCP-level SNI routing on 443:
+  #   pubray1.zeroq.su  → 3x-ui panel (TLS passthrough to 127.0.0.1:2049,
+  #                       3x-ui terminates TLS using the cert mounted
+  #                       from /var/lib/acme/pubray1.zeroq.su/)
+  #   pubrayx1.zeroq.su → Xray REALITY (TLS passthrough to 127.0.0.1:15380,
+  #                       which podman DNATs to container:443)
+  #   default           → Xray (any other SNI / IP-direct hits the REALITY
+  #                       fallback, which is what we want)
+  # nginx stream does not inspect TLS — the SNI is read from the ClientHello
+  # via ssl_preread, then the entire TCP stream (including the rest of the
+  # TLS handshake) is forwarded as-is to the chosen upstream. So Xray sees
+  # the client connect on its real configured port (443) even though the
+  # host-side port from podman's perspective is 15380.
+  streamConfig = ''
+    stream {
+        ssl_preread on;
+
+        # pubray1.zeroq.su SNI → 3x-ui panel (TLS terminated inside the
+        # container using the LE cert mounted from /var/lib/acme/).
+        # Everything else (including any sni the REALITY client uses,
+        # e.g. media.mediavitrina.ru) → Xray. So a single domain
+        # pubray1.zeroq.su serves both panel and Xray — the SNI in the
+        # TLS ClientHello disambiguates.
+        map $ssl_preread_server_name $sni_backend {
+          default            xray;
+          pubray1.zeroq.su   panel;
+        }
+
+        upstream panel {
+          server 127.0.0.1:2049;
+        }
+
+        upstream xray {
+          server 127.0.0.1:15380;
+        }
+
+        server {
+          listen 443;
+          proxy_pass $sni_backend;
+          proxy_timeout 600s;
+          proxy_connect_timeout 5s;
+        }
+    }
+  '';
 in
 {
   users.users.nginx.extraGroups = [ "acme" ];
   services = {
     nginx = {
       enable = true;
+      # No virtualHosts.<name>.locations for /, /subs/, /subsjs/, /clash/
+      # anymore — port 443 is now owned by the stream block, and the
+      # 3x-ui panel serves those paths itself once TLS is forwarded to it.
+      # Recommended HTTP options retained (still apply to the port-80
+      # ACME server block).
       recommendedGzipSettings = true;
       recommendedOptimisation = true;
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
       virtualHosts = {
+        # ACME only — nginx owns no HTTP server on 443 anymore. The
+        # cert at /var/lib/acme/pubray1.zeroq.su/ is consumed by the
+        # 3x-ui container (mounted into /root/cert/) so it can do its
+        # own TLS termination on 2049. Don't add forceSSL here: that
+        # would generate an HTTPS server block on 443 that conflicts
+        # with the stream listener above.
         "pubray1.zeroq.su" = {
-          forceSSL = true;
           enableACME = true;
-          locations = {
-            "/" = {
-              proxyPass = "http://localhost:2049";
-              proxyWebsockets = true;
-            };
-            "/subs/" = {
-              proxyPass = "http://localhost:2096";
-              proxyWebsockets = true;
-            };
-            "/subsjs/" = {
-              proxyPass = "http://localhost:2096";
-              proxyWebsockets = true;
-            };
-            "/clash/" = {
-              proxyPass = "http://localhost:2096";
-              proxyWebsockets = true;
-            };
-          };
         };
       };
+      # Top-level nginx.conf snippet — `stream {}` lives outside `http {}`,
+      # so it can't go through virtualHosts / appendHttpConfig. The NixOS
+      # nginx module exposes appendConfig for this.
+      appendConfig = streamConfig;
     };
   };
   security.acme = {