oqyude 26e53e96bd vds: SNI-route TLS on 443 to Xray (15380→443) and 3x-ui panel (2049) ...

nginx stream + ssl_preread reads the ClientHello SNI and forwards the
raw TCP stream (no TLS termination) to either:
  - 3x-ui panel on 127.0.0.1:2049 (SNI=pubray1.zeroq.su)
  - Xray on 127.0.0.1:15380 (SNI=pubrayx1.zeroq.su or default)

podman maps host:15380 → container:443 so Xray inside sees the client
on port 443 (matching its REALITY config) even though the host-side
port from podman's perspective is 15380. Host:2049 still maps to
container:2049 — 3x-ui now terminates TLS itself using the Let's
Encrypt cert mounted from /var/lib/acme/pubray1.zeroq.su/.

x-ui.db: webCertFile, webKeyFile and webDomain set so the panel
answers HTTPS on 2049. nginx no longer owns a server block on 443 —
only an ACME-only vhost for cert renewal.

REALITY inbound on container:443 still needs to be created via the
panel UI (the xrayTemplateConfig doesn't have it yet). The host-side
and routing plumbing is ready for it.

2026-08-28 00:36:54 +03:00

..

default.nix

br v4

2026-08-11 22:13:53 +03:00

glances.nix

glances added

2026-04-11 12:54:52 +03:00

netbird.nix

new domain

2026-04-10 10:57:20 +03:00

nginx.nix

vds: SNI-route TLS on 443 to Xray (15380→443) and 3x-ui panel (2049)

2026-08-28 00:36:54 +03:00

samba.nix

some fix

2026-03-27 17:56:12 +03:00

systemd.nix

path refactoring

2026-08-09 01:11:23 +03:00

xray.nix

Init

2026-03-09 10:50:12 +03:00