pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-11-08 22:25:00 +03:00
Code Issues Packages Projects Releases Wiki Activity

docs(readme): refresh all seven READMEs for the current feature set

Browse Source 
The READMEs had not moved since 2026-07-07, 341 commits ago, and had
drifted far enough to misdescribe the panel: AmneziaWG and MTProto
inbounds were missing from the protocol list entirely, the outbound
list predated PIA, and the API section still advertised Swagger rather
than scoped, optionally expiring tokens.

Add the two missing protocols plus a bullet each for what makes them
notable — AmneziaWG runs on the embedded userspace netstack, so unlike
the DKMS/awg-quick shape it originally shipped with there is nothing to
install, and MTProto client edits hot-apply through the mtg-multi
management API instead of bouncing the process. Fold the smaller
additions into the bullets they belong to (HWID device limits, IP-limit
exemptions, renewal cycles, inbound cloning, balancer-to-balancer
fallback, geosite/geoip browsing, named subscription formats) and add
one for PWA installability.

Point documentation at docs.sanaei.dev, which the panel sidebar already
links to and which supersedes the wiki, using each README's own locale
where the docs site has one (fa/ru/zh). Bump the pinned install example
to the current stable tag, note the .sha256 verification install.sh and
update.sh now perform, and document XUI_NODE_TOKEN_KEY_FILE /
XUI_NODE_TOKEN_KEY, which no markdown in the repo covered.

All seven files move together so the language picker keeps pointing at
equivalent documents.
This commit is contained in:
Sanaei
2026-09-04 09:49:25 +02:00
parent 2e81865a02
commit 3ef06b7000
11 changed files with 261 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/content/docs/en/reference/env-vars.mdx
+31 -1
View File
@@ -1,6 +1,6 @@
---
title: Environment Variables
description: Complete reference for 3x-ui's XUI_* environment variables — database, panel, logging, memory, and the tunnel health monitor.
description: Complete reference for 3x-ui's XUI_* environment variables — database, panel, logging, memory, node token encryption, and the tunnel health monitor.
icon: Variable
---
@@ -33,6 +33,36 @@ The default SQLite database path is `/etc/x-ui/x-ui.db`. See
| `XUI_ENABLE_FAIL2BAN` | `true` | Enable Fail2ban-based IP-limit enforcement. |
| `XUI_SKIP_HSTS` | `false` | Skip the HSTS header — set `true` when TLS is terminated by a reverse proxy. |
## Node token encryption
Node API bearer tokens — and the stored PIA token — are kept in plaintext by
default. Encryption at rest is opt-in and fails closed: with any mode other than
`off`, the panel refuses to start unless it can load a key.
| Variable | Default | Description |
| ------------------------- | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `NODE_TOKEN_ENCRYPTION` | `off` | `off`, `migration` (reads accept plaintext or ciphertext, writes encrypt), or `required` (same writes, startup fails without a key). Note the missing `XUI_` prefix. |
| `XUI_NODE_TOKEN_KEY_FILE` | `/etc/x-ui/node_token_key.json` | JSON keyring, mode `0600` or stricter. Loaded first. |
| `XUI_NODE_TOKEN_KEY` | — | A single base64 32-byte key, read only when the key file fails to load. Its key id is fixed to `env`, so it cannot rotate. |
The key file names the active key plus every older key still needed to decrypt:
```json
{ "active": "k1", "keys": { "k1": "<base64 32-byte key>" } }
```
Generate a key with `openssl rand -base64 32`; keys are never accepted as
command-line arguments. After enabling a mode, re-encrypt the rows already in
the database under the active key:
```bash
x-ui encrypt-tokens
```
That covers node rows; the PIA token is re-encrypted the next time it is read.
To rotate, add the new key to `keys`, point `active` at it, keep the old key for
decryption, and run `x-ui encrypt-tokens` again.
## Logging & binaries
| Variable | Default | Description |