mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-09-17 07:37:15 +00:00
PathGao
ad288a7ecc
* fix(sub): honor trustedProxyCIDRs before forwarded URLs * fix(sub): avoid unused trust-setting lookups Skip the trustedProxyCIDRs lookup when no forwarded header can affect a subscription URL. Keep the shipped proxy default in one exported setting constant and document the subscription-link behavior for custom proxy boundaries. * fix(frontend): meet config text contrast requirements Keep compact configuration text readable in the light theme and satisfy the Storybook accessibility check. --------- Co-authored-by: PathGao <gaoyanbo@gaoyanbodeMacBook-Air.local>
78 lines
4.7 KiB
Plaintext
78 lines
4.7 KiB
Plaintext
---
|
||
title: Panel Settings
|
||
description: Every 3x-ui panel setting — web server, TLS, display, security, and notifications — with defaults from the source.
|
||
icon: SlidersHorizontal
|
||
---
|
||
|
||
**Panel Settings** controls how the panel itself is served and secured (separate
|
||
from your inbounds and clients). Settings are stored as key/value pairs; the
|
||
defaults below come straight from the panel source. Secrets (tokens, passwords)
|
||
are shown only as a "set / not set" indicator and are never returned to the
|
||
browser in full.
|
||
|
||
## Web server
|
||
|
||
| Setting | Default | Meaning |
|
||
| ------------------- | ----------------------- | ----------------------------------------------------------------------- |
|
||
| `webPort` | `2053` | Panel port (1–65535). The `XUI_PORT` env var overrides it at runtime. |
|
||
| `webListen` | _(all interfaces)_ | Bind the panel to a specific IP. |
|
||
| `webBasePath` | `/` | URL path the panel is served under (always normalized to `/…/`). |
|
||
| `webCertFile` / `webKeyFile` | _(none)_ | TLS certificate + key. When both are set, the panel serves **HTTPS**. |
|
||
| `sessionMaxAge` | `360` | Session lifetime in **minutes** (default 6 hours). |
|
||
| `trustedProxyCIDRs` | `127.0.0.1/32,::1/128` | IPs/CIDRs whose forwarded headers (real client IP) are trusted. A custom value also controls forwarded host and scheme in subscription links; include the subscription proxy or set `subURI` to override those links. |
|
||
| `panelOutbound` | _(none)_ | Route the panel's own egress (update checks, Telegram, geo/sub fetches) through a named Xray outbound. |
|
||
|
||
After changing the port or base path, the panel URL becomes
|
||
`http(s)://<server>:<port><web-base-path>`. You can preset the base path on first
|
||
launch with [`XUI_INIT_WEB_BASE_PATH`](/docs/reference/env-vars).
|
||
|
||
### TLS
|
||
|
||
Serving the panel over HTTPS protects your credentials in transit. Either set
|
||
`webCertFile` + `webKeyFile` — the [`x-ui` SSL menu](/docs/config/ssl-certificates)
|
||
can obtain a Let's Encrypt certificate for you — or terminate TLS at a
|
||
[reverse proxy](/docs/operations/reverse-proxy).
|
||
|
||
<Callout type="warn">
|
||
Never expose the panel over plain HTTP on the public internet. Use TLS, a
|
||
non-default port, and a long random web base path.
|
||
</Callout>
|
||
|
||
## Display
|
||
|
||
| Setting | Default | Meaning |
|
||
| ---------------- | ------------------------------------------------ | ------------------------------------------------------------- |
|
||
| `pageSize` | `25` | Rows per page in lists (`0` disables pagination). |
|
||
| `expireDiff` | `0` | Days before expiry to start warning. |
|
||
| `trafficDiff` | `0` | Percent of quota remaining at which to start warning. |
|
||
| `remarkTemplate` | `{{INBOUND}}-{{EMAIL}}\|📊{{TRAFFIC_LEFT}}\|⏳{{DAYS_LEFT}}D` | Default client remark template (see [Share links](/docs/config/share-links#remark-template-variables)). |
|
||
| `timeLocation` | `Local` | Time zone for stats and expiry. |
|
||
| `datepicker` | `gregorian` | Calendar for date inputs (Gregorian or Jalali/Persian). |
|
||
|
||
## Security & authentication
|
||
|
||
Credentials, two-factor auth, the brute-force limiter, sessions, and LDAP are
|
||
covered in [First login](/docs/guide/first-login) and
|
||
[Security](/docs/operations/security). In short:
|
||
|
||
- Passwords are stored as **bcrypt** hashes; changing them logs out all sessions.
|
||
- **2FA (TOTP)** can be required at login.
|
||
- An **LDAP** fallback can authenticate users when the local password check fails.
|
||
- API access uses **API tokens** managed under Panel Settings (see the
|
||
[API reference](/docs/reference/api/api-tokens)).
|
||
|
||
## Notifications & subscription
|
||
|
||
These have their own settings groups and pages:
|
||
|
||
<Cards>
|
||
<Card title="Telegram bot" href="/docs/operations/telegram-bot" description="Token, chat IDs, alerts, and reports." />
|
||
<Card title="Subscription" href="/docs/config/subscription" description="Subscription server, formats, and paths." />
|
||
<Card title="Security" href="/docs/operations/security" description="2FA, IP limits, and hardening." />
|
||
</Cards>
|
||
|
||
<Callout type="info">
|
||
Email (SMTP) notifications are also configurable (host, port, encryption,
|
||
recipients) with the same event types as the Telegram bot.
|
||
</Callout>
|