mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-08-27 21:47:14 +00:00
chore(deploy): drop the AWS golden-image build stack
Remove the release-driven Packer AMI/qcow2 pipeline and everything that existed only to feed it: the image.yml workflow, deploy/packer, deploy/lightsail, deploy/firstboot, the AWS Marketplace checklist, and the first-boot smoke test/job. Keep the cloud-agnostic unattended-install path (cloud-init + install.sh non-interactive) and the Hetzner notes, which never depended on the workflow. Hetzner's snapshot path is dropped too since it relied on firstboot to avoid admin/admin on clones; cloud-init regenerates per-instance credentials on its own. Update deploy/README, the cloud-init and Hetzner docs, the root README plus its six translations, and .gitattributes to match.
This commit is contained in:
MHSanaei
@@ -1,92 +0,0 @@
|
||||
# Publishing 3x-ui to the AWS Marketplace (AMI)
|
||||
|
||||
This is the checklist for turning the Packer-built AMI into an AWS Marketplace
|
||||
listing. It assumes you have already built an AMI with
|
||||
[`../../packer/`](../../packer/) (locally or via `.github/workflows/image.yml`).
|
||||
|
||||
> Do **not** commit AMI IDs, AWS account numbers, or credentials. The AMI ID is
|
||||
> printed to the workflow job summary at build time.
|
||||
|
||||
## 1. Seller registration (one-time)
|
||||
|
||||
1. Sign in to the [AWS Marketplace Management Portal](https://aws.amazon.com/marketplace/management/)
|
||||
with the AWS account that will own the listing.
|
||||
2. Complete **seller registration** (legal entity, bank, tax interview). Required
|
||||
before any product can be submitted.
|
||||
|
||||
## 2. Build a compliant AMI
|
||||
|
||||
Build in the seller account (or share the AMI into it):
|
||||
|
||||
```bash
|
||||
cd deploy/packer
|
||||
packer init .
|
||||
# amd64
|
||||
packer build -only='amazon-ebs.x-ui' \
|
||||
-var 'xui_version=vX.Y.Z' -var 'xui_arch=amd64' -var 'instance_type=t3.small' -var 'region=eu-central-1' .
|
||||
# arm64 (Graviton)
|
||||
packer build -only='amazon-ebs.x-ui' \
|
||||
-var 'xui_version=vX.Y.Z' -var 'xui_arch=arm64' -var 'instance_type=t4g.small' -var 'region=eu-central-1' .
|
||||
```
|
||||
|
||||
You can list both AMIs (amd64 + arm64) as architectures of a single Marketplace
|
||||
product, or as separate products.
|
||||
|
||||
The image already satisfies the Marketplace AMI policies enforced by `harden.sh`
|
||||
+ `cleanup.sh`:
|
||||
|
||||
- ✅ `PasswordAuthentication no`, `PermitRootLogin prohibit-password`
|
||||
- ✅ no default OS account passwords (all locked)
|
||||
- ✅ no baked `authorized_keys`, no SSH host keys (regenerated on boot)
|
||||
- ✅ base OS = current Ubuntu 24.04 LTS, patched at build time
|
||||
- ✅ no application default credentials — the panel admin is generated on first
|
||||
boot on a random high port (no `admin/admin`, no shipped `x-ui.db`)
|
||||
|
||||
## 3. Run the self-service AMI scan
|
||||
|
||||
1. In the Management Portal: **Server products → AMIs → Upload/scan an AMI**.
|
||||
2. Share the AMI with the AWS Marketplace scanning account when prompted
|
||||
(the portal gives you the exact account id and the `modify-image-attribute`
|
||||
command, or share it from the EC2 console).
|
||||
3. Start the scan. It checks SSH config, default credentials, open ports, and
|
||||
for malware. Fix any finding and re-scan.
|
||||
|
||||
Common scan findings and where they're handled:
|
||||
|
||||
| Finding | Fix (already in the build) |
|
||||
| --- | --- |
|
||||
| Password authentication enabled | `harden.sh` sshd drop-in |
|
||||
| Root login with password | `harden.sh` `PermitRootLogin prohibit-password` |
|
||||
| Default user password set | `harden.sh` `passwd -l` on all accounts |
|
||||
| Authorized keys present | `cleanup.sh` removes them |
|
||||
| Out-of-date packages | base image is the latest LTS; `provision.sh` runs `apt-get update` |
|
||||
|
||||
## 4. Create the product (limited / private first)
|
||||
|
||||
1. **Server products → Create new product → AMI** (or AMI + CloudFormation).
|
||||
2. Add title, description, categories, pricing (free or paid), regions, the AMI
|
||||
id, recommended instance types, and the **usage instructions** (tell buyers
|
||||
to read `/etc/x-ui/credentials.txt` / MOTD after first boot for the generated
|
||||
admin login, then change the password).
|
||||
3. Submit as a **Limited** (private) listing first. AWS publishes it with
|
||||
restricted visibility so only your account / allow-listed accounts see it.
|
||||
|
||||
## 5. Preview & launch test
|
||||
|
||||
1. From the limited listing, **subscribe and launch** a test instance.
|
||||
2. SSH in, `sudo cat /etc/x-ui/credentials.txt`, open the panel URL, log in,
|
||||
confirm the panel works and the credentials are unique to that instance.
|
||||
3. Launch a second instance and confirm its credentials differ (no shared
|
||||
secrets).
|
||||
|
||||
## 6. Go public
|
||||
|
||||
1. Once the scan passes and the preview looks correct, request **public
|
||||
visibility** (move from Limited to Public) in the listing.
|
||||
2. AWS does a final review before the listing goes live.
|
||||
|
||||
## References
|
||||
|
||||
- AWS Marketplace seller guide: <https://docs.aws.amazon.com/marketplace/latest/userguide/>
|
||||
- AMI-based product requirements: <https://docs.aws.amazon.com/marketplace/latest/userguide/product-and-ami-policies.html>
|
||||
- Self-service AMI scanning: <https://docs.aws.amazon.com/marketplace/latest/userguide/product-submission.html>
|
||||
@@ -1,9 +1,10 @@
|
||||
# 3x-ui on Hetzner Cloud
|
||||
|
||||
Hetzner Cloud does **not** have a third-party image marketplace the way AWS does.
|
||||
There are two practical ways to ship 3x-ui on Hetzner.
|
||||
Ship 3x-ui via **cloud-init**: each instance installs non-interactively and
|
||||
generates unique per-instance credentials (no `admin/admin`, no shared secret).
|
||||
|
||||
## Option A — cloud-init (recommended, no image build)
|
||||
## cloud-init (no image build)
|
||||
|
||||
Use the generic user-data from [`../../cloud-init/`](../../cloud-init/). It installs
|
||||
3x-ui non-interactively and generates unique per-instance credentials.
|
||||
@@ -27,28 +28,6 @@ After boot, fetch the generated credentials:
|
||||
ssh root@<server-ip> 'cat /etc/x-ui/install-result.env'
|
||||
```
|
||||
|
||||
## Option B — snapshot from the qcow2 / a configured server
|
||||
|
||||
Hetzner lets you create a **snapshot** of a running server and launch new
|
||||
servers from it. Two ways to get there:
|
||||
|
||||
1. **From the Packer qcow2:** Hetzner does not allow direct qcow2 upload via the
|
||||
normal API, but you can boot a server, write the image to its disk in rescue
|
||||
mode, then take a snapshot — or simply use Option A, which needs no image.
|
||||
2. **From a configured server:** spin up a server, install via cloud-init
|
||||
(Option A), verify, then **delete `/etc/x-ui/x-ui.db` and the first-boot
|
||||
sentinel** before snapshotting so clones regenerate their own credentials:
|
||||
|
||||
```bash
|
||||
systemctl stop x-ui
|
||||
rm -f /etc/x-ui/x-ui.db /etc/x-ui/.firstboot-done /etc/x-ui/credentials.txt
|
||||
# re-enable first-boot regeneration if you installed via Packer:
|
||||
systemctl enable x-ui-firstboot 2>/dev/null || true
|
||||
```
|
||||
|
||||
> ⚠️ If you snapshot a server **with** its `x-ui.db`, every clone shares the
|
||||
> same admin credentials and session secret. Always remove the DB first.
|
||||
|
||||
## "App"-style listing
|
||||
|
||||
Hetzner's curated apps live in the community repo
|
||||
|
||||
Reference in New Issue
Block a user