x-ui-deployment-scheme.md

X-UI Deployment Scheme

This document outlines the architecture for deploying and accessing the X-UI web interface, leveraging Nginx for secure HTTPS access and Chisel for tunneling.

Components:

1. X-UI Docker Container:

   • Runs the X-UI application, listening on port 2053.
   • Includes a chisel client that establishes a reverse tunnel.

2. Chisel Client (inside Docker Container):

   • Connects to vds1.iri1968.dpdns.org on port 80.
   • Establishes a reverse tunnel: R:8443:localhost:2053. This means any traffic sent to localhost:8443 on vds1.iri1968.dpdns.org will be forwarded to localhost:2053 inside the Docker container (where X-UI is running).

3. Nginx on vds1.iri1968.dpdns.org:

   • HTTPS Listener (Port 443):
     • Listens for secure HTTPS traffic on vds1.iri1968.dpdns.org.
     • Uses Let's Encrypt SSL certificates for secure communication.
     • Proxies all incoming requests to http://localhost:8443 on the vds1 server.
     • Includes WebSocket support headers (Upgrade and Connection: upgrade) for proper X-UI panel and proxy traffic handling.
   • HTTP Listener (Port 80):
     • Listens for insecure HTTP traffic on vds1.iri1968.dpdns.org.
     • Redirects all HTTP traffic to HTTPS (https://$host$request_uri;).

Access Flow:

1. User Access (Browser):

   • The user opens their web browser and navigates to https://vds1.iri1968.dpdns.org.

2. Nginx Processing (on vds1.iri1968.dpdns.org):

   • Nginx receives the HTTPS request on port 443.
   • It decrypts the SSL traffic using the configured certificates.
   • Nginx then proxies this request internally to http://localhost:8443 on the vds1 server.

3. Chisel Server Processing (on vds1.iri1968.dpdns.org):

   • The chisel server (which is configured to listen on port 8443 due to the reverse tunnel initiated by the client in the Docker container) receives the request from Nginx.
   • The chisel server forwards this request through the established chisel tunnel back to the chisel client running inside the Docker container.

4. Chisel Client & X-UI (inside Docker Container):

   • The chisel client inside the Docker container receives the request from the chisel server.
   • It then forwards this request to localhost:2053 within its own container, where the X-UI web interface is actively listening.
   • X-UI processes the request and sends the response back through the same tunnel in reverse.

Summary of Access Points:

• Primary Access (Recommended): https://vds1.iri1968.dpdns.org (secure, external access via Nginx and Chisel tunnel).
• Direct Container Access (Local Only): http://localhost:2053 (if the container's port 2053 is mapped to the host's 2053, for local testing/development).

This setup ensures secure, encrypted communication from the user's browser to the Nginx server, and then leverages the chisel tunnel for secure and reliable internal communication to the X-UI application, even if the X-UI container is behind a NAT or firewall.