简报·YT
← 返回 GitHub 动态
MHSanaei/3x-ui · ⭐ 已Star 已完成

MHSanaei/3x-ui v3.8.0

2026-09-14 17:11 · ⭐ 4.6万 · GitHub Release 原文 ↗
#代理面板 #订阅管理 #安装加固

MHSanaei/3x-ui v3.8.0

一句话概括:本次大版本引入 TUIC v5 入站、AmneziaWG 出站与 Discord 通知机器人,升级内置 Xray-core 至 v26.9.9,并对订阅体系、多节点一致性和安装安全性做了系统性加固(含一次性自动迁移与数项行为变更)。

新增能力

改进与性能

修复问题(重点)

破坏性变更与升级须知

▸ Release Notes 英文原文(24149 字符)
## 🚀 TUIC v5, AmneziaWG outbounds, Discord notifications, Xray-core v26.9.9 & hardened installs - 🚀 **TUIC v5 inbounds** — a bundled `tuic-server` sidecar terminates TUIC and relays into Xray for per-client stats and routing, with `tuic://` share links, Clash output and a dedicated QR config tab. - 🛰️ **AmneziaWG everywhere** — AmneziaWG is now an outbound protocol too, Clash subscriptions can emit AmneziaWG proxies, multi-server NordLynx outbounds arrive alongside, and the embedded tunnel picked up a dozen relay, MTU, keying, locking and throughput fixes. - 💬 **Discord notifications** — a new Discord bot service mirrors the Telegram alerts with its own settings tab, while the Telegram bot gained ownership checks, HTML escaping, mutex-safe state and callback fixes. - ⚙️ **Xray-core v26.9.9** — two core bumps with one-time template migrations for the keys the new core refuses or deprecates, the `udpHop` → `udphop` mask move, and outbound protocol ids read case-insensitively everywhere the panel looks at them. - 📡 **Subscription overhaul** — client-app integration headers and curated routing presets, routing profiles and DNS servers baked into JSON subscriptions, a legacy Clash endpoint, a dummy info/status node, opt-in month-end expiry display, an HWID slot-status endpoint and locally generated Crypt5 links. - 🔐 **Hardened installs** — release archives ship SHA-256 sums that `install.sh`/`update.sh` verify, geo databases are checked against published digests, the SQLite store is owner-only, fresh panels get random subscription paths, and the fail2ban override moved to `jail.d`. - 🖧 **Multi-node correctness** — client edits fan out to every node concurrently, node snapshots can no longer resurrect deleted clients or hijack another inbound's client, and a newly selected inbound is imported instead of swept. - 🧩 **Panel UX** — a global Ctrl+K command palette, linked host remarks in the inbound list, a Reality scan-candidate setting, geodata source presets, a routing-rule comment field and a Generate button for tunnel preshared keys. - 🔗 **Share-link fidelity** — imports keep mKCP seed/headerType, Shadowsocks TLS params and obfuscation, VMess certificate checks and `vcn`; Clash output drops nodes it cannot express and emits bare hosts. > ℹ️ **Heads-up:** The first start after upgrading runs several **one-time automatic migrations**: stored Xray templates are rewritten for keys the new core refuses or deprecates (outbound `proxySettings` → `sockopt.dialerProxy`, freedom `domainStrategy` → `sockopt`, dns-outbound `nonIPQuery`/`blockTypes` → `rules`), the SQLite directory and files are tightened to **0700/0600** (a failed chmod is logged, not fatal), a legacy MTProto custom share address becomes a **Host**, and a `subSortIndex` of 0 is renumbered to 1. **Behavior changes:** a wrong API Bearer token now returns **401** instead of 404; JSON subscriptions bind their local SOCKS/HTTP inbounds to **127.0.0.1** and disable TCP mux on Vision outbounds; an empty REALITY `minClientVer` now means **no minimum**; growing a node's inbound selection re-arms adoption so the added inbound is imported rather than swept. **TUIC v5** needs the `tuic-server` sidecar, which the release archives, Docker image and `install.sh` now place next to the panel binary (it is no longer copied to `/usr/local/bin`), and `install.sh`/`update.sh` verify the archive's published **SHA-256** sidecar, aborting on mismatch or fetch failure (a 404 on older tags only warns). Fresh installs get **random subscription paths** while existing settings are preserved; building needs **Go 1.27.1** and the bundled core is **Xray-core v26.9.9**. <h3>🆕 New</h3> - [feat(tuic): add TUIC v5 inbounds via the tuic-server sidecar](https://github.com/MHSanaei/3x-ui/commit/6d96accd) (#6337) @momachka2 - [feat(amneziawg): add AmneziaWG as an outbound protocol](https://github.com/MHSanaei/3x-ui/commit/d5ab84e8) (#6320) @rqzbeh - [feat(nord): support multi-server NordLynx outbounds](https://github.com/MHSanaei/3x-ui/commit/f9cfd87c) (#6311) @Masterain98 - [feat(outbounds): support custom subscription user agents](https://github.com/MHSanaei/3x-ui/commit/9f07951b) (#6398) @T3RR7 - [feat(discord): add Discord notification bot service](https://github.com/MHSanaei/3x-ui/commit/bf7ce2da) (#6486) @poise52 - [feat(sub): add client-app integration headers, routing presets, and app management](https://github.com/MHSanaei/3x-ui/commit/14566580) (#6434) @Pejman-Yousefi-Official - [feat(sub): refine routing presets, serverDescription escaping, and auto-detect placement](https://github.com/MHSanaei/3x-ui/commit/cba8f067) (#6488) @Pejman-Yousefi-Official - [feat(sub): bake client routing profiles into the JSON subscription](https://github.com/MHSanaei/3x-ui/commit/2dd903ea) (#6402) @DIMFLIX - [feat(sub): let the panel set the JSON subscription DNS servers](https://github.com/MHSanaei/3x-ui/commit/2730e4d0) (#6485) @DIMFLIX - [feat(sub): leastLoad member weights for subscription balancers](https://github.com/MHSanaei/3x-ui/commit/7100fbcd) (#6304) @DIMFLIX - [feat(settings): add Block tab for JSON subscription routing rules](https://github.com/MHSanaei/3x-ui/commit/b332d884) (#6466) @mrchatam - [feat(sub): generate Crypt5 subscription links locally](https://github.com/MHSanaei/3x-ui/commit/6a5b4fab) (#6494) @NgaiYeanCoi - [feat(sub): add legacy Clash subscription endpoint](https://github.com/MHSanaei/3x-ui/commit/64b6e43e) (#6338) @duqigit - [feat(sub): add AmneziaWG proxy generation for Clash subscriptions](https://github.com/MHSanaei/3x-ui/commit/876497db) (#6326) @VibeProgramm - [feat(sub): add dummy info node and status configs for subscriptions](https://github.com/MHSanaei/3x-ui/commit/9f76a66d) (#6412) @rqzbeh - [feat(sub): add read-only HWID device-slot status endpoint](https://github.com/MHSanaei/3x-ui/commit/89ee1242) (#6380) @Namso9 - [feat(sub): add opt-in month-end expiry presentation](https://github.com/MHSanaei/3x-ui/commit/c90996ed) (#6517) @JacktheRanger - [feat(clients): let admins set PersistentKeepalive on tunnel clients](https://github.com/MHSanaei/3x-ui/commit/8f162994) (#6377) @YoungReckless4 - [feat(clients): add Generate button for WireGuard/AmneziaWG PresharedKey](https://github.com/MHSanaei/3x-ui/commit/22763fe8) (#6455) @mrchatam - [feat(clients): support setting HWID limit and MTProto ad-tag in bulk adjust](https://github.com/MHSanaei/3x-ui/commit/ed5465d0) (#6399) @rqzbeh - [feat(clients): show short HWID fingerprint in admin device list](https://github.com/MHSanaei/3x-ui/commit/8082ab4d) (#6464) @mrchatam - [feat(inbounds): show linked host remarks in inbound list](https://github.com/MHSanaei/3x-ui/commit/939c4706) (#6468) @mrchatam - [feat(settings): add setting for Reality scan candidates](https://github.com/MHSanaei/3x-ui/commit/768bbd2a) (#6471) @mrchatam - [feat(reality): warn when target cert chain is too small for ML-DSA-65](https://github.com/MHSanaei/3x-ui/commit/b467d4c6) (#6470) @mrchatam - [feat(geodata): add standard source presets](https://github.com/MHSanaei/3x-ui/commit/d600de2c) (#6504) @rokokol - [feat(routing): add panel-only comment field to routing rules](https://github.com/MHSanaei/3x-ui/commit/1bf078c5) (#6361) @Ssentiago - [feat(ui): add global command palette (Ctrl+K) for fast navigation and search](https://github.com/MHSanaei/3x-ui/commit/fc08b533) (#6352) @TheMRVX - [feat(release): publish SHA-256 sums and verify them in install.sh/update.sh](https://github.com/MHSanaei/3x-ui/commit/f294e180) (#6393) @rokokol <h3>⚡ Update & improvement</h3> - [feat(xray): update xray-core to v26.9.9 and follow the udpHop move](https://github.com/MHSanaei/3x-ui/commit/d0edbcec) - [feat(xray): update xray-core to v26.9.8 and adapt panel](https://github.com/MHSanaei/3x-ui/commit/2ec6c736) - [perf(clients): batch the client record lookup in bulk operations](https://github.com/MHSanaei/3x-ui/commit/8b9cf260) - [perf(clients): apply a multi-inbound client create concurrently](https://github.com/MHSanaei/3x-ui/commit/63b46cd6) - [perf(clients): push a bulk client change to every node at once](https://github.com/MHSanaei/3x-ui/commit/e9e2e302) - [perf(node): push a client edit to every node at once, not one after another](https://github.com/MHSanaei/3x-ui/commit/d34ec97f) - [perf(node): bound the per-client node push and fan out the traffic reset](https://github.com/MHSanaei/3x-ui/commit/a5e68f41) - [perf(amneziawg): return gVisor's pooled buffers on the embedded data path](https://github.com/MHSanaei/3x-ui/commit/24cb6bfe) - [refactor(tgbot): make the add-client expiry presets say what they do](https://github.com/MHSanaei/3x-ui/commit/2fcd28c1) (#6503) @BlindMaster24 - [docs(readme): refresh all seven READMEs for the current feature set](https://github.com/MHSanaei/3x-ui/commit/3ef06b70) - [docs: add Discord bot to READMEs, architecture, operations guides, and locales](https://github.com/MHSanaei/3x-ui/commit/a09e1360) (#6513) @poise52 - [docs: add TUIC v5 to READMEs, guides, and protocol references](https://github.com/MHSanaei/3x-ui/commit/2d7c8c77) (#6511) @poise52 - [docs(api): align OpenAPI with runtime contracts](https://github.com/MHSanaei/3x-ui/commit/ed6bc1d8) (#6409) @LineGM - [docs(api): mark collection responses nullable](https://github.com/MHSanaei/3x-ui/commit/b8597314) (#6430) @LineGM - [docs(readme): add 3X-UI Manager to Community Tools](https://github.com/MHSanaei/3x-ui/commit/3a932357) (#6266) @yukh975 - [chore(deps): update frontend and Go deps and fix the AntD Space API](https://github.com/MHSanaei/3x-ui/commit/dd46a067) - [chore(deps): bump Go dependency versions](https://github.com/MHSanaei/3x-ui/commit/38dd9bcc) - [chore(deps): raise the swagger-ui-react js-yaml override to 4.3.2](https://github.com/MHSanaei/3x-ui/commit/33e6c2ec) <h3>🐞 Bug fixed</h3> - [fix(xray): read an outbound protocol id the way the core does](https://github.com/MHSanaei/3x-ui/commit/4d6db1c9) (#6521) @BlindMaster24 - [fix(panel): read outbound protocol ids case-insensitively everywhere](https://github.com/MHSanaei/3x-ui/commit/c0c2dd27) (#6523) @BlindMaster24 - [fix(panel): read an outbound protocol id the way the core does](https://github.com/MHSanaei/3x-ui/commit/a5a4c9cd) (#6522) @BlindMaster24 - [fix(panel): read the outbound protocol id in the Outbounds row like the core](https://github.com/MHSanaei/3x-ui/commit/c0271e23) (#6528) @BlindMaster24 - [fix(outbound): read the probe protocol id and transport name like the core](https://github.com/MHSanaei/3x-ui/commit/f69d1e86) (#6526) @BlindMaster24 - [fix(outbound): read the probe testability gate's ids like the core](https://github.com/MHSanaei/3x-ui/commit/efcf1529) (#6527) @BlindMaster24 - [fix(panel): probe UDP outbounds and hide the block outbound from the mtproto egress picker](https://github.com/MHSanaei/3x-ui/commit/84c5aef4) (#6525) @BlindMaster24 - [fix(xray): migrate the dns outbound off its legacy nonIPQuery and blockTypes](https://github.com/MHSanaei/3x-ui/commit/39ce7cbc) (#6519) @BlindMaster24 - [fix(xray): place the freedom domain strategy where the core reads it](https://github.com/MHSanaei/3x-ui/commit/826e29e2) (#6515) @BlindMaster24 - [fix(xray): confine log paths written under any key case](https://github.com/MHSanaei/3x-ui/commit/f9de0226) - [fix(outbound): test VLESS vnext endpoints](https://github.com/MHSanaei/3x-ui/commit/c62ee0bb) (#6358) @sanmaxdev - [fix(outbounds): preserve stable subscription tags](https://github.com/MHSanaei/3x-ui/commit/8abe87b6) (#6345) @dawNotPoi - [fix(dns): stop offering a port field that DoH entries discard](https://github.com/MHSanaei/3x-ui/commit/c392f367) - [fix(inbounds): reject missing TLS certificates before saving](https://github.com/MHSanaei/3x-ui/commit/47d23033) (#6429) @duqigit - [fix(inbounds): serve fresh client UUIDs for list and allLinks](https://github.com/MHSanaei/3x-ui/commit/67addab3) (#6458) @mrchatam - [fix(inbounds): allow negative subSortIndex for subscription order](https://github.com/MHSanaei/3x-ui/commit/51e0afdd) (#6465) @mrchatam - [fix(inbounds): let a node-adopted inbound keep its own protocol on edit](https://github.com/MHSanaei/3x-ui/commit/2004340d) - [fix(frontend): fold sockopt v6only into V6Only on inbound load](https://github.com/MHSanaei/3x-ui/commit/958d7f13) (#6453) @mrchatam - [fix(hosts): keep TLS override fields visible when Security is same](https://github.com/MHSanaei/3x-ui/commit/72df05a4) (#6452) @mrchatam - [fix(clients): preserve traffic reset schedule when toggling enable](https://github.com/MHSanaei/3x-ui/commit/d0ad773e) (#6502) @alireza4682 - [fix(clients): snap EOM 23:59:59 expiry to billing midnight without renew](https://github.com/MHSanaei/3x-ui/commit/5cce2464) (#6457) @mrchatam - [fix(clients): sync auto-renewal across inbounds](https://github.com/MHSanaei/3x-ui/commit/b8121613) (#6339) @dawNotPoi - [fix(clients): preserve enable on portable import](https://github.com/MHSanaei/3x-ui/commit/5fbd2b49) (#6481) @mrchatam - [fix(clients): use EffectiveFlow in BulkAttach](https://github.com/MHSanaei/3x-ui/commit/0a838563) (#6454) @mrchatam - [fix(clients): keep per-peer keys when a client spans several tunnel inbounds](https://github.com/MHSanaei/3x-ui/commit/65c5580e) - [fix(clients): withdraw the delete tombstone when the email is re-created](https://github.com/MHSanaei/3x-ui/commit/bc57548a) - [fix(clients): flag the restart a partly-applied edit or delete still needs](https://github.com/MHSanaei/3x-ui/commit/f072d044) - [fix(clients): render all tunnel configs for multi-inbound client](https://github.com/MHSanaei/3x-ui/commit/47964afb) (#6349) @TheMRVX - [fix(wireguard): preserve per-inbound WireGuard peer addresses](https://github.com/MHSanaei/3x-ui/commit/f6445304) (#6344) @mvanhorn - [fix(node): import a newly selected node inbound instead of sweeping it](https://github.com/MHSanaei/3x-ui/commit/22346eef) - [fix(node): flag every hosting node before a client edit applies](https://github.com/MHSanaei/3x-ui/commit/f2cf5899) - [fix(node): let a node-reported tag outrank a stale adopted alias](https://github.com/MHSanaei/3x-ui/commit/5fc4b9f4) - [fix(node): keep an adopted inbound alias across a remote id cache refresh](https://github.com/MHSanaei/3x-ui/commit/0775fcaa) - [fix(node): sweep a selected inbound the node reports without its prefix](https://github.com/MHSanaei/3x-ui/commit/6f40a51d) - [fix(node): cap the status body the heartbeat probe decodes](https://github.com/MHSanaei/3x-ui/commit/ab422953) - [fix(node): refuse a node's claim on another inbound's client](https://github.com/MHSanaei/3x-ui/commit/a31fa9ab) - [fix(node): prevent node snapshots from resurrecting bulk-deleted clients](https://github.com/MHSanaei/3x-ui/commit/71607e38) (#6382) @mvanhorn - [fix(sub): drop external Clash shadowsocks nodes the panel cannot express](https://github.com/MHSanaei/3x-ui/commit/ff1a6c3c) (#6508) @BlindMaster24 - [fix(link): rebuild shadowsocks tcp/http obfuscation on import](https://github.com/MHSanaei/3x-ui/commit/8fc4fc0b) (#6505) @BlindMaster24 - [fix(link): read the vmess certificate checks on import](https://github.com/MHSanaei/3x-ui/commit/f3dba07e) (#6507) @BlindMaster24 - [fix(link): restore mKCP seed and headerType on share-link import](https://github.com/MHSanaei/3x-ui/commit/5ad9df69) (#6480) @mrchatam - [fix(link): preserve Shadowsocks TLS query params on import](https://github.com/MHSanaei/3x-ui/commit/503b5df4) (#6467) @mrchatam - [fix(link): map vcn to verifyPeerCertByName in applySecurity](https://github.com/MHSanaei/3x-ui/commit/f51b0040) (#6479) @mrchatam - [fix(hysteria): export standard gecko obfs share-link params and persist uTLS None](https://github.com/MHSanaei/3x-ui/commit/540caa4e) (#6325) @rqzbeh - [fix(mtproto): use hosts for public share links](https://github.com/MHSanaei/3x-ui/commit/5a63d5d4) (#6369) @samssh - [fix(sub): enable ML-KEM for Mihomo REALITY subscriptions](https://github.com/MHSanaei/3x-ui/commit/0a2cd789) (#6451) @King19950905 - [fix(sub): skip AmneziaWG JSON entries](https://github.com/MHSanaei/3x-ui/commit/4e355edc) (#6420) @atirna - [fix(sub): bind JSON local inbounds to 127.0.0.1 and keep mux.cool off Vision outbounds](https://github.com/MHSanaei/3x-ui/commit/0f6e1ae8) (#6418) @FZ1010 - [fix(sub): randomize fresh panel subscription paths](https://github.com/MHSanaei/3x-ui/commit/f9898e0b) (#6375) @rokokol - [fix(sub): apply the device limit to ?view=raw](https://github.com/MHSanaei/3x-ui/commit/f17e4684) - [fix(sub): drop Reality parameters when a host forces plain TLS](https://github.com/MHSanaei/3x-ui/commit/4e423fa4) - [fix(sub): emit a bare host in Clash proxies](https://github.com/MHSanaei/3x-ui/commit/246d9207) - [fix(sub): restore compatible SOCKS subscription inbound](https://github.com/MHSanaei/3x-ui/commit/0c72dd83) (#6395) @dawNotPoi - [fix(sub): honor and show client expiry on external subscription links](https://github.com/MHSanaei/3x-ui/commit/2ddcf530) (#6333) @duqigit - [fix(frontend): isolate subscription language preference](https://github.com/MHSanaei/3x-ui/commit/ded2aa15) (#6394) @dawNotPoi - [fix(frontend): improve dense QR readability](https://github.com/MHSanaei/3x-ui/commit/04e84580) (#6396) @dawNotPoi - [fix(amneziawg): bound the SOCKS5 UDP associate exchange](https://github.com/MHSanaei/3x-ui/commit/cfd4f64a) - [fix(amneziawg): honor inbound listen when binding UDP socket](https://github.com/MHSanaei/3x-ui/commit/7a41c594) (#6461) @mrchatam - [fix(amneziawgnet): wait for the client netstack goroutines before closing its device](https://github.com/MHSanaei/3x-ui/commit/6ee74f20) - [fix(amneziawg): let a cleared header protection key reach a running device](https://github.com/MHSanaei/3x-ui/commit/cfd596a4) - [fix(amneziawg): stop losing an inbound and its server keys on the API path](https://github.com/MHSanaei/3x-ui/commit/705b291d) - [fix(amneziawg): reject obfuscation values amneziawg-go's own UAPI rejects](https://github.com/MHSanaei/3x-ui/commit/3b5273b1) - [fix(amneziawg): three defects in the embedded relay's connection handling](https://github.com/MHSanaei/3x-ui/commit/be5ee3e0) - [fix(amneziawg): account for S4 junk in the default tunnel MTU](https://github.com/MHSanaei/3x-ui/commit/3cd3836d) (#6376) @YoungReckless4 - [fix(amneziawg): H1-H4 generator + queue-depth throughput fixes](https://github.com/MHSanaei/3x-ui/commit/bd1c27b0) (#6330) @kuzzrus - [fix(amneziawg): avoid manager lock inversion](https://github.com/MHSanaei/3x-ui/commit/e95fe80f) (#6397) @dawNotPoi - [fix(tuic): evict the oldest relay flow instead of refusing new clients](https://github.com/MHSanaei/3x-ui/commit/5815254f) - [fix(install): stop copying tuic-server over /usr/local/bin](https://github.com/MHSanaei/3x-ui/commit/19a692e0) - [fix(tgbot): close stale-inbound TOCTOU and contain handler panics](https://github.com/MHSanaei/3x-ui/commit/87420e3b) (#6442) @BlindMaster24 - [fix(tgbot): suppress 'message not modified' warnings in Telegram edit calls](https://github.com/MHSanaei/3x-ui/commit/8e13f8b1) (#6340) @BlindMaster24 - [fix(tgbot): require client ownership for non-admin link callbacks](https://github.com/MHSanaei/3x-ui/commit/7ac5277c) (#6489) @BlindMaster24 - [fix(tgbot): read the admin list and running flag under their mutex](https://github.com/MHSanaei/3x-ui/commit/615876b2) (#6491) @BlindMaster24 - [fix(tgbot): render the add-client draft as HTML and escape its values](https://github.com/MHSanaei/3x-ui/commit/02c6c3a9) (#6492) @BlindMaster24 - [fix(tgbot): answer the callbacks the bot cannot route](https://github.com/MHSanaei/3x-ui/commit/aaa5e61c) (#6493) @BlindMaster24 - [fix(tgbot): answer only the link callbacks that match nothing](https://github.com/MHSanaei/3x-ui/commit/b98f947e) - [fix(tgbot): send the admin traffic reports as one message](https://github.com/MHSanaei/3x-ui/commit/c7518c40) (#6490) @BlindMaster24 - [fix(tgbot): keep the add-client draft with the chat that owns it](https://github.com/MHSanaei/3x-ui/commit/1691c9ca) (#6499) @BlindMaster24 - [fix(tgbot): render a disabled start-after-first-use client as days](https://github.com/MHSanaei/3x-ui/commit/e98be4f7) (#6500) @BlindMaster24 - [fix(discord): page the inbounds reply within Discord's embed caps](https://github.com/MHSanaei/3x-ui/commit/d45a09d6) (#6496) @BlindMaster24 - [fix(discord): drop the gateway connection when heartbeats go unanswered](https://github.com/MHSanaei/3x-ui/commit/5c34baa8) (#6497) @BlindMaster24 - [fix(discord): report a start-after-first-use client as days, not unlimited](https://github.com/MHSanaei/3x-ui/commit/cc60cefe) (#6498) @BlindMaster24 - [fix(api): return 401 for invalid Bearer token instead of 404](https://github.com/MHSanaei/3x-ui/commit/bdd351bd) (#6459) @mrchatam - [fix(web): restart panel after ImportDB so subPath routes match](https://github.com/MHSanaei/3x-ui/commit/435ed976) (#6456) @mrchatam - [fix(settings): show the SMTP failure reason instead of a raw i18n key](https://github.com/MHSanaei/3x-ui/commit/efc603f5) - [fix(ui): keep the empty-group placeholder legible in dark mode](https://github.com/MHSanaei/3x-ui/commit/0fbdf0f9) - [fix(logs): standardize login and logout logs](https://github.com/MHSanaei/3x-ui/commit/4760ccab) (#6484) @Mapioe - [fix(logs): stop logging a successful login twice](https://github.com/MHSanaei/3x-ui/commit/de18c5a0) (#6374) @Mapioe - [fix(cli): let -getApiToken name the token it regenerates](https://github.com/MHSanaei/3x-ui/commit/d2ac3b4d) (#6405) @rokokol - [fix(api-docs): generate request bodies for all encodings](https://github.com/MHSanaei/3x-ui/commit/0ff3c239) (#6296) @rokokol - [fix(database): keep the SQLite store owner-only](https://github.com/MHSanaei/3x-ui/commit/23511108) (#6390) @rokokol - [fix(geofile): verify downloaded geo databases against published digests](https://github.com/MHSanaei/3x-ui/commit/fc05249e) (#6404) @rokokol - [fix(install): fetch x-ui.sh and unit files from the installed release tag](https://github.com/MHSanaei/3x-ui/commit/195988bd) (#6391) @rokokol - [fix(x-ui.sh): put the fail2ban backend override in jail.d, not jail.conf](https://github.com/MHSanaei/3x-ui/commit/4019f47d) (#6392) @rokokol <h3> Reports </h3> ![Total Download](https://img.shields.io/github/downloads/mhsanaei/3x-ui/v3.8.0/total?label=Total-Download&color=success) ## New Contributors * @VibeProgramm made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6326 * @duqigit made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6333 * @momachka2 made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6337 * @BlindMaster24 made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6340 * @TheMRVX made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6349 * @Mapioe made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6374 * @YoungReckless4 made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6376 * @Namso9 made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6380 * @T3RR7 made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6398 * @LineGM made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6409 * @atirna made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6420 * @Pejman-Yousefi-Official made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6434 * @King19950905 made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6451 * @poise52 made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6486 * @NgaiYeanCoi made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6494 * @alireza4682 made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6502 * @JacktheRanger made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6517 **Full Changelog**: https://github.com/MHSanaei/3x-ui/compare/v3.7.0...v3.8.0
▸ 主项目介绍 · MHSanaei/3x-ui
▸ README 原文(同步于 2026-09-13 16:24)
[English](/README.md) | [فارسی](/README.fa_IR.md) | [العربية](/README.ar_EG.md) | [中文](/README.zh_CN.md) | [Español](/README.es_ES.md) | [Русский](/README.ru_RU.md) | [Türkçe](/README.tr_TR.md) <p align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="./media/3x-ui-dark.png"> <img alt="3x-ui" src="./media/3x-ui-light.png"> </picture> </p> <p align="center"> <a href="https://github.com/MHSanaei/3x-ui/releases"><img src="https://img.shields.io/github/v/release/mhsanaei/3x-ui" alt="Release"></a> <a href="https://github.com/MHSanaei/3x-ui/actions"><img src="https://img.shields.io/github/actions/workflow/status/mhsanaei/3x-ui/release.yml.svg" alt="Build"></a> <a href="#"><img src="https://img.shields.io/github/go-mod/go-version/mhsanaei/3x-ui.svg" alt="GO Version"></a> <a href="https://github.com/MHSanaei/3x-ui/releases/latest"><img src="https://img.shields.io/github/downloads/mhsanaei/3x-ui/total.svg" alt="Downloads"></a> <a href="https://www.gnu.org/licenses/gpl-3.0.en.html"><img src="https://img.shields.io/badge/license-GPL%20V3-blue.svg?longCache=true" alt="License"></a> <a href="https://pkg.go.dev/github.com/mhsanaei/3x-ui/v3"><img src="https://pkg.go.dev/badge/github.com/mhsanaei/3x-ui/v3.svg" alt="Go Reference"></a> <a href="https://docs.sanaei.dev"><img src="https://img.shields.io/badge/docs-docs.sanaei.dev-22d3ee" alt="Documentation"></a> </p> **3X-UI** 是一个先进的开源 Web 控制面板,用于管理 [Xray-core](https://github.com/XTLS/Xray-core) 服务器。它提供简洁、多语言的界面,用于部署、配置和监控各种代理与 VPN 协议——从单台 VPS 到多节点部署。 3X-UI 作为原始 X-UI 项目的增强分支(fork),增加了更广泛的协议支持、更好的稳定性、按客户端的流量统计以及许多提升使用体验的功能。 > [!IMPORTANT] > 本项目仅供个人使用。请勿将其用于非法目的,也请勿在生产环境中使用。 ## 功能特性 - **多协议入站** — VLESS、VMess、Trojan、Shadowsocks、WireGuard、AmneziaWG、Hysteria2、MTProto、HTTP、SOCKS (Mixed)、Dokodemo-door / Tunnel 和 TUN。 - **现代传输与安全** — TCP (Raw)、mKCP、WebSocket、gRPC、HTTPUpgrade 和 XHTTP,并通过 TLS、XTLS 和 REALITY 加密。 - **内置 AmneziaWG** — 抗 DPI 的 WireGuard 直接在面板内的用户态网络栈上运行,无需内核模块、DKMS 或额外软件包。 - **MTProto 代理** — 按客户端配置 FakeTLS 密钥、广告标签和配额,实时生效且不会断开已有连接。 - **回落 (Fallback)** — 通过 Xray 的 fallback 功能在单个端口上提供多种协议(例如在 443 端口上同时使用 VLESS 和 Trojan)。 - **按客户端管理** — 流量配额、到期日期、可豁免受信任地址的 IP 限制、HWID 设备数限制、定时续期周期、实时在线状态,以及一键分享链接、二维码和订阅。 - **流量统计** — 按入站、按客户端、按出站统计,并支持重置控制。 - **多节点支持** — 从单一面板管理并扩展到多台服务器,并可将入站克隆到其他节点。 - **出站与路由** — WARP、NordVPN、PIA、自定义路由规则、支持均衡器间回退的负载均衡器,以及出站代理链。内置的 geosite 与 geoip 分类可直接在规则编辑器中浏览。 - **内置订阅服务器** — 提供 raw、JSON 和 Clash 输出,可依据客户端 User-Agent 自动选择,并支持[自定义页面模板](docs/custom-subscription-templates.md)。 - **Telegram 机器人**,用于远程监控和管理。 - **RESTful API**,支持带作用域、可设置有效期的令牌,并提供面板内置的 API 参考文档。 - **可安装面板 (PWA)** — 将 3X-UI 固定到桌面或手机主屏幕。 - **灵活的存储** — SQLite(默认)或 PostgreSQL。 - **13 种界面语言**,支持深色和浅色主题。 - **Fail2ban 集成**,用于强制执行按客户端的 IP 限制。 ## 截图 <details> <summary>点击展开</summary> <picture> <source media="(prefers-color-scheme: dark)" srcset="./media/01-overview-dark.png"> <img alt="Overview" src="./media/01-overview-light.png"> </picture> <picture> <source media="(prefers-color-scheme: dark)" srcset="./media/02-add-inbound-dark.png"> <img alt="Inbounds" src="./media/02-add-inbound-light.png"> </picture> <picture> <source media="(prefers-color-scheme: dark)" srcset="./media/03-add-client-dark.png"> <img alt="Add client" src="./media/03-add-client-light.png"> </picture> <picture> <source media="(prefers-color-scheme: dark)" srcset="./media/05-add-nodes-dark.png"> <img alt="Configs" src="./media/05-add-nodes-light.png"> </picture> </details> ## 快速开始 ```bash bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh) ``` 若要安装特定版本,请在命令后附加对应的标签(例如 `v3.7.0`): ```bash bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh) v3.7.0 ``` 若要安装滚动更新的 **dev** 版本(来自 `main` 的最新逐次提交预发布版本,而非稳定版本),请传入 `dev-latest`: ```bash bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh) dev-latest ``` 安装过程中会生成随机的用户名、密码和访问路径。安装完成后,运行 `x-ui` 打开管理菜单,您可以在其中启动/停止服务、查看或重置登录凭据、管理 SSL 证书等。 每个发布资源都会在其旁边附带一个 `.sha256` 校验和。`install.sh` 和更新程序都会据此校验压缩包,不匹配时中止。 完整文档(安装、配置、运维以及完整的 API 参考)请访问 **[docs.sanaei.dev](https://docs.sanaei.dev/zh)**。 ### 无人值守安装 安装程序也可以**非交互式**运行,适用于 cloud-init。 设置 `XUI_NONINTERACTIVE=1`(或在无 TTY 的情况下通过管道传入),它就会全程 零提示地完成端到端安装,生成随机凭据并写入 `/etc/x-ui/install-result.env`。请参阅 [`deploy/`](deploy/): - [Cloud-init user-data](deploy/cloud-init/) — 在任意云平台上无人值守安装(Hetzner/AWS/DO/Vultr/GCP/Azure/Oracle) - [Hetzner Cloud 说明](deploy/marketplace/hetzner/) — 在 Hetzner 上基于 cloud-init 的部署 ## 支持的平台 **操作系统:** Ubuntu、Debian、Armbian、Fedora、CentOS、RHEL、AlmaLinux、Rocky Linux、Oracle Linux、Amazon Linux、Virtuozzo、Arch、Manjaro、Parch、openSUSE (Tumbleweed / Leap)、Alpine 和 Windows。 **架构:** `amd64` · `386` · `arm64` (aarch64) · `armv7` · `armv6` · `armv5` · `s390x`。 ## 数据库选项 3X-UI 支持两种后端,可在安装时选择: - **SQLite**(默认)— 位于 `/etc/x-ui/x-ui.db` 的单个文件。无需配置,适合中小型部署。 - **PostgreSQL** — 推荐用于大量客户端或多节点设置。安装程序可以为您在本地安装 PostgreSQL,或接受指向现有服务器的 DSN。 运行时通过环境变量选择后端(安装程序会为您写入 `/etc/default/x-ui`): ``` XUI_DB_TYPE=postgres XUI_DB_DSN=postgres://xui:password@127.0.0.1:5432/xui?sslmode=disable ``` ### 将现有的 SQLite 安装迁移到 PostgreSQL ```bash x-ui migrate-db --dsn "postgres://xui:password@127.0.0.1:5432/xui?sslmode=disable" # 然后在 /etc/default/x-ui 中设置 XUI_DB_TYPE 和 XUI_DB_DSN 并重启: systemctl restart x-ui ``` 源 SQLite 文件保持不变;在确认新后端正常工作后,请手动删除它。 ### Docker 默认的 `docker compose up -d` 仍使用 SQLite。若要使用捆绑的 PostgreSQL 服务运行,请取消注释 `docker-compose.yml` 中的两行 `XUI_DB_*` 环境变量,并使用该 profile 启动: ```bash docker compose --profile postgres up -d ``` 该镜像捆绑了 Fail2ban(默认启用),用于强制执行按客户端的 **IP 限制**。Fail2ban 使用 `iptables` 封禁违规者,这需要 `NET_ADMIN` 权限。`docker-compose.yml` 已通过 `cap_add` 授予该权限;如果您改用 `docker run` 启动容器,请自行添加这些权限,否则封禁只会被记录而永远不会生效: ```bash docker run -d --cap-add=NET_ADMIN --cap-add=NET_RAW ... ghcr.io/mhsanaei/3x-ui ``` ## 环境变量 | 变量 | 说明 | 默认值 | | --- | --- | --- | | `XUI_DB_TYPE` | 数据库后端:`sqlite` 或 `postgres` | `sqlite` | | `XUI_DB_DSN` | PostgreSQL 连接字符串(当 `XUI_DB_TYPE=postgres` 时) | — | | `XUI_DB_FOLDER` | SQLite 数据库文件所在目录 | `/etc/x-ui` | | `XUI_DB_MAX_OPEN_CONNS` | 最大打开连接数(PostgreSQL 连接池) | — | | `XUI_DB_MAX_IDLE_CONNS` | 最大空闲连接数(PostgreSQL 连接池) | — | | `XUI_INIT_WEB_BASE_PATH` | Web 面板的初始 URI 路径 | `/` | | `XUI_ENABLE_FAIL2BAN` | 启用基于 Fail2ban 的 IP 限制 | `true` | | `XUI_LOG_LEVEL` | 日志级别(`debug`、`info`、`warning`、`error`) | `info` | | `XUI_DEBUG` | 启用调试模式 | `false` | | `XUI_TUNNEL_HEALTH_MONITOR` | 启用隧道健康监控(探测某个 URL,在连续多次失败后重启 xray;重启会断开所有客户端) | `false` | | `XUI_TUNNEL_HEALTH_PROXY` | 探测请求所经过的代理;将其指向本地 xray 入站,使探测能够测试隧道(例如 `socks5://127.0.0.1:1080`)。留空表示探测仅检查主机连通性 | — | | `XUI_TUNNEL_HEALTH_URL` | 用于检测隧道健康状况的探测 URL | `https://www.cloudflare.com/cdn-cgi/trace` | | `XUI_TUNNEL_HEALTH_INTERVAL` | 两次探测之间的间隔 | `30s` | | `XUI_TUNNEL_HEALTH_TIMEOUT` | 单次探测的超时时间 | `10s` | | `XUI_TUNNEL_HEALTH_FAILURES` | 触发重启前的连续失败次数 | `3` | | `XUI_TUNNEL_HEALTH_COOLDOWN` | 两次连续重启之间的最小间隔 | `5m` | | `NODE_TOKEN_ENCRYPTION` | 节点 API 令牌的静态加密:`off`、`migration` 或 `required`(注意:无 `XUI_` 前缀) | `off` | | `XUI_NODE_TOKEN_KEY_FILE` | JSON 密钥环(权限 `0600`),包含活动密钥 ID 及其 base64 编码的 32 字节密钥 | `/etc/x-ui/node_token_key.json` | | `XUI_NODE_TOKEN_KEY` | 单个 base64 编码的 32 字节密钥,仅在无法加载密钥文件时使用 | — | 完整列表请参阅[环境变量参考](https://docs.sanaei.dev/zh/docs/reference/env-vars)。 ## 支持的语言 面板界面提供 13 种语言: English · فارسی · العربية · 中文(简体) · 中文(繁體) · Español · Русский · Українська · Türkçe · Tiếng Việt · 日本語 · Bahasa Indonesia · Português (Brasil) ## 贡献 欢迎贡献。在提交 issue 或 pull request 之前,请阅读[贡献指南](/CONTRIBUTING.md)。 ## 特别感谢 - [alireza0](https://github.com/alireza0/) ## 致谢 - [Iran v2ray rules](https://github.com/chocolate4u/Iran-v2ray-rules) (许可证: **GPL-3.0**): _增强的 v2ray/xray 和 v2ray/xray-clients 路由规则,内置伊朗域名,专注于安全性和广告拦截。_ - [Russia v2ray rules](https://github.com/runetfreedom/russia-v2ray-rules-dat) (许可证: **GPL-3.0**): _此仓库包含基于俄罗斯被阻止域名和地址数据自动更新的 V2Ray 路由规则。_ ## 社区工具 社区围绕 3x-ui 构建的工具和集成。 - [terraform-provider-3x-ui](https://github.com/batonogov/terraform-provider-threexui) (许可证: **MIT**): _使用 Terraform / OpenTofu 通过代码管理入站、客户端、面板设置和 Xray 配置。_ - [3X-UI Manager](https://github.com/yukh975/3X-UI-Manager) (许可证: **MIT**): _3x-ui 的原生 Android 客户端 — 仪表板、入站、带二维码分享的客户端、节点以及多面板管理。可在 F-Droid 获取。_ ## 支持项目 **如果这个项目对您有帮助,您可以给它一个**:star2: <a href="https://www.buymeacoffee.com/MHSanaei" target="_blank"> <img src="./media/default-yellow.png" alt="Buy Me A Coffee" style="height: 70px !important;width: 277px !important;" > </a> </br> <a href="https://nowpayments.io/donation/hsanaei" target="_blank" rel="noreferrer noopener"> <img src="./media/donation-button-black.svg" alt="Crypto donation button by NOWPayments"> </a> ## 星标历史 <a href="https://www.star-history.com/?repos=mhsanaei%2F3x-ui&type=date&legend=top-left"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=mhsanaei/3x-ui&type=date&theme=dark&legend=top-left" /> <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=mhsanaei/3x-ui&type=date&legend=top-left" /> <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=mhsanaei/3x-ui&type=date&legend=top-left" /> </picture> </a> <p align="center"> <a href="https://www.star-history.com/mhsanaei/3x-ui"> <picture><source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/badge?repo=MHSanaei/3x-ui&type=rank&theme=dark" /><source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/badge?repo=MHSanaei/3x-ui&type=rank" /><img alt="Star History Rank" src="https://api.star-history.com/badge?repo=MHSanaei/3x-ui&type=rank" /></picture> <picture><source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/badge?repo=MHSanaei/3x-ui&type=trending&theme=dark" /><source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/badge?repo=MHSanaei/3x-ui&type=trending" /><img alt="GitHub Trending Repository of the Day" src="https://api.star-history.com/badge?repo=MHSanaei/3x-ui&type=trending" /></picture> </a> </p>