$ show MHSanaei/3x-ui
This repository is a full-featured web control panel for managing Xray-core proxy servers, known as 3x-ui. It provides a complete management interface for creating and configuring proxy inbounds (VLESS, VMess, Trojan, Shadowsocks, WireGuard, AmneziaWG, TUIC, Hysteria, MTProto, etc.), managing client accounts with traffic quotas and expiry, operating multi-node distributed setups, and generating subscription links (v2ray, Clash, JSON). The backend is written in Go using the Gin web framework and GORM for database access (SQLite or PostgreSQL), while the frontend is a React/TypeScript SPA with Ant Design and TanStack Query. The system includes sidecar supervision for Xray-core, MTProto (mtg), and TUIC binaries, a Telegram bot, Discord integration, email notifications, and an API token system. It features extensive automated testing (unit, integration, scale, mutation tests) and a documentation site built with Next.js and fumadocs.
The LLM identified 5 files worth highlighting for reuse:
A typed in-process event bus with per-subscriber buffered channels, non-blocking delivery, and automatic panic recovery. Supports event filtering and dynamic subscription management. Decouples notification producers (outbound status changes, security events, node transitions) from consumers (Telegram bot, email, Discord). Demonstrates safe concurrent publish-subscribe with bounded memory and graceful error handling.
A codec for node-to-panel configuration transport that uses zstd compression with a SHA-256 hash header for integrity verification. Encodes config payloads as compressed binary blobs with a version/hash envelope, enabling efficient and secure push of Xray configurations to remote nodes. The pattern is self-contained and reusable for any system needing compact, verifiable message serialization over HTTP.
A serialized database writer that routes all traffic counter mutations through a single goroutine to prevent deadlocks between concurrent traffic polling and admin CRUD operations. Uses a buffered channel as a command queue and ensures atomicity without relying on database-level locking. The pattern is documented with its evolution from a buggy sync.Once-based implementation, demonstrating production-level concurrency debugging.
A WebSocket bridge that merges server-pushed updates (traffic stats, inbound/client changes) directly into TanStack Query's cache, providing real-time UI updates without polling. Handles connection lifecycle, reconnection with exponential backoff, and selective invalidation of query keys. Demonstrates a clean separation between WebSocket event handling and React state management.
A SSRF protection utility that creates an HTTP client with a custom dialer that blocks requests to private IP ranges (RFC 1918, loopback, link-local, etc.) and restricts allowed ports. Used when fetching external subscription URLs or contacting upstream APIs to prevent server-side request forgery attacks. Self-contained with configurable blocklist and port restrictions.