mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-11-03 11:45:04 +03:00
MHSanaei
9b91f0f42e
Fold the standalone 3x-ui-docs project (Next.js 16 + Fumadocs, deployed to docs.sanaei.dev) into docs/ so the panel and its documentation share a single source of truth, the way sing-box keeps its docs in-tree. The old repo becomes redundant and can be retired. - Import the full site under docs/ (app, components, content, lib, public, scripts, config). The self-contained pnpm project sits alongside the existing engineering notes with no filename collisions. - Re-point "Edit on GitHub" links from MHSanaei/3x-ui-docs to this repo's docs/content/docs path (docs/lib/shared.ts, docs/app/.../page.tsx). - Add docs-ci.yml and docs-deploy.yml under .github/workflows/, scoped to docs/** and run with working-directory: docs, since GitHub only runs workflows from the repo-root .github/. deploy-static.yml's GitHub Pages publish (CNAME docs.sanaei.dev) carries over unchanged. Follow-up (outside this commit): attach the docs.sanaei.dev custom domain to this repository's Pages (or set the Vercel project's root directory to docs), confirm the site is live from the monorepo, then delete MHSanaei/3x-ui-docs.
52 lines
1.5 KiB
Plaintext
52 lines
1.5 KiB
Plaintext
---
|
|
title: Reverse Proxy
|
|
description: Put the 3x-ui panel and subscription behind Nginx or Caddy with Let's Encrypt TLS.
|
|
icon: Waypoints
|
|
---
|
|
|
|
A reverse proxy lets you serve the panel and subscription on a clean domain with
|
|
automatic HTTPS, and hide the real ports behind ports 80/443. Prefer to let the
|
|
panel terminate TLS directly? Get a certificate with the
|
|
[`x-ui` SSL menu](/docs/config/ssl-certificates) instead.
|
|
|
|
## Generate a config
|
|
|
|
<ReverseProxyGenerator />
|
|
|
|
<Callout type="info">
|
|
The panel uses WebSockets for live updates, so the proxy must pass the
|
|
`Upgrade`/`Connection` headers (the Nginx output above already does). Caddy
|
|
handles WebSocket upgrades automatically.
|
|
</Callout>
|
|
|
|
## Nginx + certificate
|
|
|
|
With Nginx, obtain a certificate with `certbot` (or `acme.sh`) and reference it
|
|
in the server block:
|
|
|
|
```bash title="certbot"
|
|
certbot certonly --nginx -d panel.example.com
|
|
```
|
|
|
|
Reload Nginx after installing the certificate, and set up automatic renewal
|
|
(`certbot renew` runs on a timer by default).
|
|
|
|
## Caddy
|
|
|
|
Caddy obtains and renews certificates for you — point a Caddyfile at the panel
|
|
and it just works:
|
|
|
|
```text title="Caddyfile"
|
|
panel.example.com {
|
|
reverse_proxy 127.0.0.1:2053
|
|
}
|
|
```
|
|
|
|
## Tips
|
|
|
|
- Keep the panel's **web base path** even behind a proxy; defense in depth.
|
|
- If you terminate TLS at the proxy, you may want `XUI_SKIP_HSTS=true` on the
|
|
panel — see the [environment variables reference](/docs/reference/env-vars).
|
|
- Proxy the [subscription](/docs/config/subscription) server too, so its contents
|
|
are served over HTTPS.
|