MHSanaei/3x-ui

3x-ui is a self-hosted control panel for running proxy servers on your own host, aimed at people who want to manage multiple protocols and users from one web UI instead of hand-editing Xray configuration files.

The problem

Setting up a working proxy server usually means writing and maintaining a JSON config for each protocol, adding users by hand, and tracking who used how much traffic and when their access should end. That operational bookkeeping gets messy as soon as there is more than one protocol, one port or one machine. 3x-ui changes that step: you add an inbound, attach clients with quotas and expiry dates, and the panel writes the underlying configuration for you. The result is a running service, share links or QR codes and subscription exports, plus traffic figures per inbound, client and outbound.

What's different

The project bundles protocols that are often deployed separately — VLESS, VMess, Trojan, Shadowsocks, WireGuard, AmneziaWG, TUIC v5, Hysteria2, MTProto, HTTP/SOCKS mixed, tunnel and TUN — and adds transports including WebSocket, gRPC, HTTPUpgrade and XHTTP with TLS, XTLS and REALITY. The practical benefit is breadth without separate server software: AmneziaWG runs in a userspace stack with no kernel module or extra package, and TUIC v5 is an in-process QUIC server that feeds the same Xray routing and per-client accounting. Fallbacks let several protocols share one port, which simplifies certificate and port planning.

The trade-off is that the panel becomes a privileged management surface in front of a network service. Fail2ban-based IP limits are enforced through iptables and need NET_ADMIN, so a docker run deployment that omits the capability logs bans without applying them. The default SQLite single file is convenient for small setups, but high client counts or multiple nodes are better served by the PostgreSQL backend, including the documented migration path. Multi-node management and cloning inbounds across servers add convenience but also mean one panel now governs several hosts.

Who should try it

It fits someone with their own server who wants a multi-user proxy with per-client quotas, expiry, IP or HWID limits and subscription links without writing config files by hand. It also suits small operators who need several protocols on one port or one panel across a few nodes. A poor fit is a single user who only needs one protocol on one machine: the panel and its database are extra moving parts for little gain. The unattended installer, cloud-init templates for common clouds and Docker Compose path matter for anyone deploying repeatedly, while someone who wants a built-in service with no host-level privileges will find the Fail2ban capability requirement inconvenient.

Requirements and limitations

The installer targets a list of Linux distributions plus Windows, with amd64, 386, arm64 and various arm and s390x architectures, so the server platform should be checked before committing. Database choice is a lasting decision rather than a checkbox: SQLite is a single file at /etc/x-ui/x-ui.db, and the documented PostgreSQL migration leaves the source file untouched for manual removal after verification. Ongoing upkeep includes the service lifecycle, random credentials generated at install, certificate management through the x-ui menu, and keeping Fail2ban enforcement working under containers.

The installer is bootstrapped with a fetched shell script, releases ship adjacent .sha256 sums that the installer and updater verify, and a rolling dev-latest pre-release path exists for those who want main-branch builds rather than stable tags; that is a real operational distinction, not a cosmetic one. Setup details and the API reference live in the documentation, and deployment templates in the deploy directory.

HotRepo's take

HotRepo's only dated record is a single GitHub Trending daily-board appearance on 2026-10-25, when the repository stood at 48,535 stars with +59 that day. With one observed date, persistence of interest cannot be judged. The repository was created in February 2023, which says nothing by itself about maintenance quality. Before adopting, confirm the database backend you need and whether your deployment path preserves the Fail2ban NET_ADMIN requirement; those two choices affect daily operation more than the protocol list.