Muse
6a5ee8f77b
Display L-UI; panel binary/process l-ui, agent lui-agent. Dirs /usr/local/l-ui, /etc/l-ui, /var/log/l-ui; DB /etc/l-ui/l-ui.db (name file drives it via GetName), probe.db beside it, cert /etc/l-ui/cert, bin /usr/local/l-ui/bin. Services l-ui.service / lui-agent.service, OpenRC lui-agent, l-ui.sh, cmd/lui-agent. Env prefix XUI_ -> LUI_ (code reads new prefix only). Release assets l-ui-linux-* / lui-agent-linux-*; Gitea repo rogue/l-ui is a placeholder pending user confirmation (see selfupdate.go note). Go module path github.com/mhsanaei/3x-ui/v3 intentionally kept. Versions unchanged: panel V2.6.0 / agent A2.5.0.
52 lines
1.5 KiB
Plaintext
52 lines
1.5 KiB
Plaintext
---
|
|
title: Reverse Proxy
|
|
description: Put the L-UI panel and subscription behind Nginx or Caddy with Let's Encrypt TLS.
|
|
icon: Waypoints
|
|
---
|
|
|
|
A reverse proxy lets you serve the panel and subscription on a clean domain with
|
|
automatic HTTPS, and hide the real ports behind ports 80/443. Prefer to let the
|
|
panel terminate TLS directly? Get a certificate with the
|
|
[`l-ui` SSL menu](/docs/config/ssl-certificates) instead.
|
|
|
|
## Generate a config
|
|
|
|
<ReverseProxyGenerator />
|
|
|
|
<Callout type="info">
|
|
The panel uses WebSockets for live updates, so the proxy must pass the
|
|
`Upgrade`/`Connection` headers (the Nginx output above already does). Caddy
|
|
handles WebSocket upgrades automatically.
|
|
</Callout>
|
|
|
|
## Nginx + certificate
|
|
|
|
With Nginx, obtain a certificate with `certbot` (or `acme.sh`) and reference it
|
|
in the server block:
|
|
|
|
```bash title="certbot"
|
|
certbot certonly --nginx -d panel.example.com
|
|
```
|
|
|
|
Reload Nginx after installing the certificate, and set up automatic renewal
|
|
(`certbot renew` runs on a timer by default).
|
|
|
|
## Caddy
|
|
|
|
Caddy obtains and renews certificates for you — point a Caddyfile at the panel
|
|
and it just works:
|
|
|
|
```text title="Caddyfile"
|
|
panel.example.com {
|
|
reverse_proxy 127.0.0.1:2053
|
|
}
|
|
```
|
|
|
|
## Tips
|
|
|
|
- Keep the panel's **web base path** even behind a proxy; defense in depth.
|
|
- If you terminate TLS at the proxy, you may want `LUI_SKIP_HSTS=true` on the
|
|
panel — see the [environment variables reference](/docs/reference/env-vars).
|
|
- Proxy the [subscription](/docs/config/subscription) server too, so its contents
|
|
are served over HTTPS.
|