46 lines
1.8 KiB
YAML
46 lines
1.8 KiB
YAML
# 3x-ui master panel — vp.kzbrd.ru
|
|
# Multi-node: master manages node(s) on VPS over their API (Bearer token / mTLS).
|
|
# Docs: https://docs.sanaei.dev/docs/operations/multi-node/
|
|
# NOTE: panel port NOT published to host — only reachable via Traefik (traefik_proxy).
|
|
# Local API access: docker exec 3xui_master wget -qO- http://127.0.0.1:2053/...
|
|
services:
|
|
3xui:
|
|
image: ghcr.io/mhsanaei/3x-ui:latest
|
|
container_name: 3xui_master
|
|
restart: unless-stopped
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
environment:
|
|
XUI_DB_FOLDER: /etc/x-ui
|
|
XUI_SKIP_HSTS: "true" # TLS terminated by Traefik
|
|
XUI_ENABLE_FAIL2BAN: "false" # panel behind Traefik; NET_ADMIN caps kept for optional xray use
|
|
volumes:
|
|
- ./db/:/etc/x-ui/
|
|
- ./cert/:/root/cert/
|
|
- ./acme/:/root/.acme.sh/
|
|
networks:
|
|
- proxy
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=traefik_proxy"
|
|
- "traefik.http.routers.xui.rule=Host(`vp.kzbrd.ru`)"
|
|
- "traefik.http.routers.xui.entrypoints=websecure"
|
|
- "traefik.http.routers.xui.tls=true"
|
|
- "traefik.http.routers.xui.tls.certresolver=myresolver"
|
|
- "traefik.http.routers.xui.service=xui"
|
|
- "traefik.http.services.xui.loadbalancer.server.port=2053"
|
|
# Subscription server (3x-ui sub service on :2096) — /sub/<subId> URLs
|
|
- "traefik.http.routers.xui-sub.rule=Host(`vp.kzbrd.ru`) && PathPrefix(`/sub`)"
|
|
- "traefik.http.routers.xui-sub.entrypoints=websecure"
|
|
- "traefik.http.routers.xui-sub.tls=true"
|
|
- "traefik.http.routers.xui-sub.tls.certresolver=myresolver"
|
|
- "traefik.http.routers.xui-sub.service=xui-sub"
|
|
- "traefik.http.services.xui-sub.loadbalancer.server.port=2096"
|
|
- "com.centurylinklabs.watchtower.enable=true"
|
|
|
|
networks:
|
|
proxy:
|
|
external: true
|
|
name: traefik_proxy
|