Deployment Overview of 3X-UI Graphics Panel on Server¶

Prerequisites and Basic Requirements¶

To ensure a successful deployment, the server must meet the following requirements:

• Operating System: Ubuntu or Debian (for apt-based systems) or CentOS, Rocky Linux, or AlmaLinux (for yum/dnf-based systems).

• Privileges: Root or sudo access is required to install packages and manage Docker services.

• Network/Ports:

• Port 22/tcp: SSH access.

• Port 80/tcp: HTTP for SSL certificate validation (Certbot).

• Port 443/tcp: HTTPS for secure panel access.

• Internal application port: 34171 (default configuration).

FQDN of the final panel on the hostkey.in domain¶

The application is accessible via a specific subdomain template based on your server ID.

File and Directory Structure¶

The deployment utilizes several directories for configuration, data persistence, and SSL certificates:

• /root/3x-ui: Contains the Docker Compose configuration file.

• /data/3x-ui/db/: Stores the application database.

• /data/3x-ui/cert/: Application certificate storage.

• /data/nginx/user_conf.d/: Contains Nginx virtual host configurations.

• /data/nginx/letsencrypt/: Used for ACME challenge files (SSL validation).

• /data/nginx/nginx-certbot.env: Environment configuration for the SSL container.

Application Installation Process¶

The installation process follows these steps:

1. System Preparation: The system is updated, and necessary dependencies such as ca-certificates, curl, and gnupg are installed.

2. Docker Engine Installation:

3. For Debian/Ubuntu: The official Docker repository is configured via GPG keys, and the docker-ce suite is installed.

4. For RHEL/CentOS/Rocky/AlmaLinux: The official Docker CE repository is added to enable installation of docker-ce, containerd.io, and docker-compose-plugin.

5. Kernel Optimization: TCP BBR (Bottleneck Bandwidth and Round-trip propagation time) is enabled via sysctl to improve network performance (net.core.default_qdisc = fq and net.ipv4.tcp_congestion_control = bbr).

6. Service Deployment: The application is deployed using Docker Compose, which orchestrates both the 3X-UI panel and an Nginx reverse proxy with Certbot integration.

Access Rights and Security¶

Security is managed through several layers:

• Firewall Configuration:

• On RHEL-based systems, firewalld is disabled to prevent conflicts.

• On Debian/Ubuntu-based systems, ufw is configured to allow SSH (22), HTTP (80), and HTTPS (443).

• Application Credentials: Upon installation, the application's default credentials are automatically updated for both the admin and root users using the server's secure access token.

Docker Containers and Their Deployment¶

The deployment consists of two primary containers managed via a compose.yml file located in /root/3x-ui.

3X-UI Container¶

• Image: ghcr.io/mhsanaei/3x-ui:latest

• Container Name: 3x-ui

• Ports:

• Host 443 maps to container 443.

• Internal port 34171 is exposed for the reverse proxy.

• Volumes:

• /data/3x-ui/db/ \(\rightarrow\) /etc/x-ui/

• nginx_secrets (Docker volume) \(\rightarrow\) /root/cert/

• Environment Variables:

• XRAY_VMESS_AEAD_FORCED: "false"

• Restart Policy: unless-stopped

Nginx Certbot Container¶

• Image: jonasal/nginx-certbot:latest

• Container Name: nginx-certbot

• Ports:

• Host 80 \(\rightarrow\) container 80.

• Host 34171 \(\rightarrow\) container 34171.

• Volumes:

• nginx_secrets (Docker volume) \(\rightarrow\) /etc/letsencrypt

• /data/nginx/user_conf.d/ \(\rightarrow\) /etc/nginx/user_conf.d/

• /data/nginx/letsencrypt/ \(\rightarrow\) /var/www/letsencrypt

• Environment Variables:

• [email protected]

• Restart Policy: unless-stopped

Application Update Instructions¶

To update the main application, navigate to the deployment directory and pull the latest images:

cd /root/3x-ui
docker compose pull && docker compose up -d

Location of Configuration Files and Data¶

• Database: /data/3x-ui/db/

• Nginx Configs: /data/nginx/user_conf.d/

• SSL Certificates: Managed within the nginx_secrets Docker volume, accessible via the container at /etc/letsencrypt.

Available Ports for Connection¶

• HTTPS (Secure Access): Port 443 (via Nginx proxy).

• HTTP (Redirection/Validation): Port 80.

• Internal Management: Port 34171.