Deployment Overview of 3X-UI Graphics Panel on Server¶
Prerequisites and Basic Requirements¶
To ensure a successful deployment, the server must meet the following requirements:
-
Operating System: Ubuntu, Debian, CentOS, Rocky Linux, or AlmaLinux.
-
Privileges: Root or sudo access is required for package installation and Docker configuration.
-
Network/Ports:
-
22/tcp: SSH access. -
80/tcp: HTTP (for SSL certificate challenges). -
443/tcp: HTTPS (external traffic). -
34171/tcp: Internal panel port (default configuration).
-
FQDN of the final panel on the hostkey.in domain¶
The application uses a dynamic subdomain template based on the server ID.
| Parameter | Value |
|---|---|
| Prefix | 3x-ui |
| Domain | hostkey.in |
| Full template | 3x-ui{Server_ID_from_Invapi}.hostkey.in |
File and Directory Structure¶
The deployment utilizes specific directories for configuration, data persistence, and SSL certificates:
-
/root/3x-ui: Contains the Docker Compose file. -
/data/3x-ui/db/: Stores the application database. -
/data/3x-ui/cert/: Application certificate storage. -
/data/nginx/user_conf.d/: Nginx configuration files for specific subdomains. -
/data/nginx/letsencrypt/: Let's Encrypt ACME challenge directory. -
/data/nginx/nginx-certbot.env: Environment variables for the Certbot container.
Application Installation Process¶
The application is deployed using Docker Compose. The installation process includes:
-
System preparation (BBR enablement and dependency installation).
-
Docker engine installation and configuration (
daemon.json). -
Creation of necessary directory structures with specific permissions.
-
Deployment of the
3x-uicontainer viadocker compose. -
Automatic SSL certificate acquisition and Nginx reverse proxy configuration.
Access Rights and Security¶
Security is managed through several layers:
-
Firewall:
-
On RHEL-based systems (CentOS, Rocky, AlmaLinux), the firewall is disabled (
firewalldstopped). -
On Debian/Ubuntu systems,
ufwis configured to allow SSH, HTTP, and HTTPS.
-
-
User Credentials: The installation script automatically sets credentials for both
adminandrootusers within the application settings using the provided server password. -
Network Isolation: The panel's internal port (
34171) is exposed via a reverse proxy rather than being directly accessible from the public internet on its default port.
Docker Containers and Their Deployment¶
The deployment consists of two main containers managed via docker compose:
3x-ui¶
-
Image:
ghcr.io/mhsanaei/3x-ui:latest -
Container Name:
3x-ui -
Ports:
-
Internal port:
34171(exposed via Nginx) -
External mapping:
443:443
-
-
Volumes:
-
/data/3x-ui/db/:/etc/x-ui/ -
nginx_secrets:/root/cert/
-
-
Environment Variables:
XRAY_VMESS_AEAD_FORCED: "false"
-
Restart Policy:
unless-stopped
nginx-certbot¶
-
Image:
jonasal/nginx-certbot:latest -
Container Name:
nginx-certbot -
Ports:
-
80:80 -
34171:34171(Internal panel port)
-
-
Volumes:
-
nginx_secrets:/etc/letsencrypt -
/data/nginx/user_conf.d:/etc/nginx/user_conf.d -
/data/nginx/letsencrypt:/var/www/letsencrypt
-
-
Environment Variables:
-
Renewal interval set via
/data/nginx/nginx-certbot.env(8 days).
-
Restart Policy:
unless-stopped
Application Update Instructions¶
Updates are performed by pulling the latest image and restarting containers:
Proxy Servers¶
The deployment uses an Nginx container acting as a reverse proxy with integrated Certbot for automated SSL management.
-
SSL/TLS: Automated via Let's Encrypt. Certificates are stored in the
nginx_secretsDocker volume. -
HTTP to HTTPS Redirection: The configuration includes a permanent redirect (301) from port 80 to the secure HTTPS endpoint.
-
Reverse Proxy Logic: Nginx handles SSL termination and proxies requests to the
3x-uicontainer on port34171, passing necessary headers such asHost,X-Real-IP, andUpgrade(for WebSocket support).
Location of configuration files and data¶
| Data Type | Path |
|---|---|
| Docker Compose File | /root/3x-ui/compose.yml |
| Nginx User Configs | /data/nginx/user_conf.d/ |
| Database Files | /data/3x-ui/db/ |
| SSL Certificates (Host) | /data/nginx/letsencrypt/ |
Available ports for connection¶
-
HTTPS:
443(via Nginx proxy) -
HTTP:
80(for redirection and ACME challenges)