commit f4bf6eacf45213e3f9aa0caacf0939c23daba5a2
Author: nkozobrod <kozobrod@gmail.com>
Date:   Sat Aug 15 11:18:52 2026 +0300

    3x-ui master panel (multi-node) for vp.kzbrd.ru

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..1257bd0
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,5 @@
+db/
+cert/
+acme/
+.env
+*.log
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..28b6881
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,45 @@
+# 3x-ui master panel — vp.kzbrd.ru
+# Multi-node: master manages node(s) on VPS over their API (Bearer token / mTLS).
+# Docs: https://docs.sanaei.dev/docs/operations/multi-node/
+# NOTE: panel port NOT published to host — only reachable via Traefik (traefik_proxy).
+# Local API access: docker exec 3xui_master wget -qO- http://127.0.0.1:2053/...
+services:
+  3xui:
+    image: ghcr.io/mhsanaei/3x-ui:latest
+    container_name: 3xui_master
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+      - NET_RAW
+    environment:
+      XUI_DB_FOLDER: /etc/x-ui
+      XUI_SKIP_HSTS: "true"        # TLS terminated by Traefik
+      XUI_ENABLE_FAIL2BAN: "false" # panel behind Traefik; NET_ADMIN caps kept for optional xray use
+    volumes:
+      - ./db/:/etc/x-ui/
+      - ./cert/:/root/cert/
+      - ./acme/:/root/.acme.sh/
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik_proxy"
+      - "traefik.http.routers.xui.rule=Host(`vp.kzbrd.ru`)"
+      - "traefik.http.routers.xui.entrypoints=websecure"
+      - "traefik.http.routers.xui.tls=true"
+      - "traefik.http.routers.xui.tls.certresolver=myresolver"
+      - "traefik.http.routers.xui.service=xui"
+      - "traefik.http.services.xui.loadbalancer.server.port=2053"
+      # Subscription server (3x-ui sub service on :2096) — /sub/<subId> URLs
+      - "traefik.http.routers.xui-sub.rule=Host(`vp.kzbrd.ru`) && PathPrefix(`/sub`)"
+      - "traefik.http.routers.xui-sub.entrypoints=websecure"
+      - "traefik.http.routers.xui-sub.tls=true"
+      - "traefik.http.routers.xui-sub.tls.certresolver=myresolver"
+      - "traefik.http.routers.xui-sub.service=xui-sub"
+      - "traefik.http.services.xui-sub.loadbalancer.server.port=2096"
+      - "com.centurylinklabs.watchtower.enable=true"
+
+networks:
+  proxy:
+    external: true
+    name: traefik_proxy