Deployment Overview of 3X-UI Graphics Panel on Server¶

Prerequisites and Basic Requirements¶

To ensure a successful deployment, the following requirements must be met:

• Operating System: Ubuntu or Debian (for .deb based systems) or CentOS, Rocky Linux, or AlmaLinux (for RHEL-based systems).

• Privileges: Root or sudo access is required for installing dependencies and managing Docker containers.

• Network/Ports:

  • 22/tcp: SSH access.

  • 80/tcp: HTTP (used by Certbot for SSL validation).

  • 443/tcp: HTTPS (external access via Nginx proxy).

  • 34171/tcp: Internal application port.

FQDN of the final panel on the hostkey.in domain¶

The application uses a dynamic subdomain template based on the server ID.

File and Directory Structure¶

The deployment utilizes specific directories for configuration, data persistence, and SSL certificates:

• /root/3x-ui: Contains the Docker Compose file.

• /data/3x-ui/db/: Stores the application database.

• /data/3x-ui/cert/: Application certificate storage.

• /data/nginx/user_conf.d/: Nginx configuration files for specific subdomains.

• /data/nginx/letsencrypt/: Let's Encrypt ACME challenge directory.

• /data/nginx/nginx-certbot.env: Environment variables for the Certbot container.

Application Installation Process¶

The application is deployed using Docker Compose. The process involves:

1. Installing the Docker engine and required plugins (docker-ce, containerd.io, docker-compose-plugin).

2. Configuring system parameters (enabling BBR congestion control).

3. Creating necessary directory structures with specific permissions.

4. Deploying containers via docker compose up -d.

5. Initializing the application by setting administrative credentials and the internal port via the CLI tool inside the container.

Access Rights and Security¶

• Firewall:

  • On RHEL-based systems, firewalld is disabled.

  • On Debian/Ubuntu systems, ufw is configured to allow SSH (22), HTTP (80), and HTTPS (443).

• Authentication: The application's default administrative user (admin) and a secondary root user are initialized with credentials provided during the deployment process.

Docker Containers and Their Deployment¶

The deployment consists of two main containers managed via Docker Compose:

3x-ui Container¶

• Image Name: ghcr.io/mhsanaei/3x-ui:latest

• Container Name: 3x-ui

• Ports: Exposes internal port 34171.

• Volumes:

  • /data/3x-ui/db/:/etc/x-ui/

  • nginx_secrets:/root/cert/

• Environment Variables: XRAY_VMESS_AEAD_FORCED="false"

• Restart Policy: unless-stopped

nginx-certbot Container¶

• Image Name: jonasal/nginx-certbot:latest

• Container Name: nginx-certbot

• Ports:

  • 80:80

  • 34171:34171

• Volumes:

  • nginx_secrets:/etc/letsencrypt

  • /data/nginx/user_conf.d:/etc/nginx/user_conf.d

  • /data/nginx/letsencrypt:/var/www/letsencrypt

• Environment Variables:

  • [email protected]

  • Configured via /data/nginx/nginx-certbot.env (includes RENEWAL_INTERVAL=8d).

• Restart Policy: unless-stopped

Application Update Instructions¶

Updates are performed by pulling the latest image and restarting containers:

docker compose pull && docker compose up -d

Proxy Servers¶

The deployment uses an Nginx container acting as a reverse proxy with automatic SSL management via Certbot.

• SSL/TLS: Automated certificate acquisition and renewal using Let's Encrypt.

• HTTP to HTTPS Redirection: All traffic on port 80 is redirected to the secure port (34171) via Nginx.

• Configuration: A custom Nginx configuration file is generated in /data/nginx/user_conf.d/ to handle the specific subdomain and proxy requests to the backend container.

Available Ports for Connection¶