# 3x-ui master panel — vp.kzbrd.ru
# Multi-node: master manages node(s) on VPS over their API (Bearer token / mTLS).
# Docs: https://docs.sanaei.dev/docs/operations/multi-node/
# NOTE: panel port NOT published to host — only reachable via Traefik (traefik_proxy).
# Local API access: docker exec 3xui_master wget -qO- http://127.0.0.1:2053/...
services:
  3xui:
    image: ghcr.io/mhsanaei/3x-ui:latest
    container_name: 3xui_master
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - NET_RAW
    environment:
      XUI_DB_FOLDER: /etc/x-ui
      XUI_SKIP_HSTS: "true"        # TLS terminated by Traefik
      XUI_ENABLE_FAIL2BAN: "false" # panel behind Traefik; NET_ADMIN caps kept for optional xray use
    volumes:
      - ./db/:/etc/x-ui/
      - ./cert/:/root/cert/
      - ./acme/:/root/.acme.sh/
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik_proxy"
      - "traefik.http.routers.xui.rule=Host(`vp.kzbrd.ru`)"
      - "traefik.http.routers.xui.entrypoints=websecure"
      - "traefik.http.routers.xui.tls=true"
      - "traefik.http.routers.xui.tls.certresolver=myresolver"
      - "traefik.http.routers.xui.service=xui"
      - "traefik.http.services.xui.loadbalancer.server.port=2053"
      # Subscription server (3x-ui sub service on :2096) — /sub/<subId> URLs
      - "traefik.http.routers.xui-sub.rule=Host(`vp.kzbrd.ru`) && PathPrefix(`/sub`)"
      - "traefik.http.routers.xui-sub.entrypoints=websecure"
      - "traefik.http.routers.xui-sub.tls=true"
      - "traefik.http.routers.xui-sub.tls.certresolver=myresolver"
      - "traefik.http.routers.xui-sub.service=xui-sub"
      - "traefik.http.services.xui-sub.loadbalancer.server.port=2096"
      - "com.centurylinklabs.watchtower.enable=true"

networks:
  proxy:
    external: true
    name: traefik_proxy