Deployment Overview of 3X-UI Graphics Panel on Server¶

Prerequisites and Basic Requirements¶

To ensure a successful deployment, the server must meet the following requirements:

• Operating System: Ubuntu, Debian, CentOS, Rocky Linux, or AlmaLinux.

• Privileges: Root or sudo access is required for package installation and Docker configuration.

• Network/Ports:

  • 22/tcp: SSH access.

  • 80/tcp: HTTP (for SSL certificate challenges).

  • 443/tcp: HTTPS (external traffic).

  • 34171/tcp: Internal panel port (default configuration).

FQDN of the final panel on the hostkey.in domain¶

The application uses a dynamic subdomain template based on the server ID.

File and Directory Structure¶

The deployment utilizes specific directories for configuration, data persistence, and SSL certificates:

• /root/3x-ui: Contains the Docker Compose file.

• /data/3x-ui/db/: Stores the application database.

• /data/3x-ui/cert/: Application certificate storage.

• /data/nginx/user_conf.d/: Nginx configuration files for specific subdomains.

• /data/nginx/letsencrypt/: Let's Encrypt ACME challenge directory.

• /data/nginx/nginx-certbot.env: Environment variables for the Certbot container.

Application Installation Process¶

The application is deployed using Docker Compose. The installation process includes:

1. System preparation (BBR enablement and dependency installation).

2. Docker engine installation and configuration (daemon.json).

3. Creation of necessary directory structures with specific permissions.

4. Deployment of the 3x-ui container via docker compose.

5. Automatic SSL certificate acquisition and Nginx reverse proxy configuration.

Access Rights and Security¶

Security is managed through several layers:

• Firewall:

  • On RHEL-based systems (CentOS, Rocky, AlmaLinux), the firewall is disabled (firewalld stopped).

  • On Debian/Ubuntu systems, ufw is configured to allow SSH, HTTP, and HTTPS.

• User Credentials: The installation script automatically sets credentials for both admin and root users within the application settings using the provided server password.

• Network Isolation: The panel's internal port (34171) is exposed via a reverse proxy rather than being directly accessible from the public internet on its default port.

Docker Containers and Their Deployment¶

The deployment consists of two main containers managed via docker compose:

3x-ui¶

• Image: ghcr.io/mhsanaei/3x-ui:latest

• Container Name: 3x-ui

• Ports:

  • Internal port: 34171 (exposed via Nginx)

  • External mapping: 443:443

• Volumes:

  • /data/3x-ui/db/:/etc/x-ui/

  • nginx_secrets:/root/cert/

• Environment Variables:

  • XRAY_VMESS_AEAD_FORCED: "false"

• Restart Policy: unless-stopped

nginx-certbot¶

• Image: jonasal/nginx-certbot:latest

• Container Name: nginx-certbot

• Ports:

  • 80:80

  • 34171:34171 (Internal panel port)

• Volumes:

  • nginx_secrets:/etc/letsencrypt

  • /data/nginx/user_conf.d:/etc/nginx/user_conf.d

  • /data/nginx/letsencrypt:/var/www/letsencrypt

• Environment Variables:

  • [email protected]

  • Renewal interval set via /data/nginx/nginx-certbot.env (8 days).

• Restart Policy: unless-stopped

Application Update Instructions¶

Updates are performed by pulling the latest image and restarting containers:

cd /root/3x-ui && docker compose pull && docker compose up -d

Proxy Servers¶

The deployment uses an Nginx container acting as a reverse proxy with integrated Certbot for automated SSL management.

• SSL/TLS: Automated via Let's Encrypt. Certificates are stored in the nginx_secrets Docker volume.

• HTTP to HTTPS Redirection: The configuration includes a permanent redirect (301) from port 80 to the secure HTTPS endpoint.

• Reverse Proxy Logic: Nginx handles SSL termination and proxies requests to the 3x-ui container on port 34171, passing necessary headers such as Host, X-Real-IP, and Upgrade (for WebSocket support).

Location of configuration files and data¶

Available ports for connection¶

• HTTPS: 443 (via Nginx proxy)

• HTTP: 80 (for redirection and ACME challenges)