okooooooo/3m-ui
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
4dde61e8dbcc8402f4dc245de120f514b1a2dc21
3m-ui/AGENTS.md
T
風雪 39608cd0fb fix(infra): fail-closed checksums, sandbox hardening, non-root Docker 
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
2026-08-29 09:39:25 +00:00

3.3 KiB
Raw Blame History

3m-ui Development Guide

Project Overview

3m-ui is a web management panel for Mihomo Core.

The goal is to provide a simple and powerful VPS management interface based on Mihomo Core.

Main functions:

  • Manage Mihomo Core
  • Create and manage Mihomo listeners
  • Generate Mihomo configuration files
  • Manage users
  • Generate subscriptions
  • Monitor service status
  • View logs

Technology Stack

Backend

Language:

  • Go 1.25+

Framework:

  • Gin

Database:

  • SQLite (default)
  • GORM ORM

Authentication:

  • JWT

Frontend

Framework:

  • React 19

Language:

  • TypeScript

Build tool:

  • Vite

UI:

  • Ant Design

State management:

  • Zustand or Redux Toolkit

Routing:

  • React Router

Project Architecture

Backend:

backend/

├── cmd/ │ └── server/

├── internal/

│ ├── auth/ │ │ Authentication logic

│ ├── mihomo/ │ │ Mihomo Core management

│ ├── listener/ │ │ Listener management

│ ├── subscription/ │ │ Subscription generation

│ ├── system/ │ │ Linux system operations

│ └── database/ │ Database models and migrations

Frontend:

frontend/

src/

├── api/ │ API requests

├── pages/ │ Main pages

├── components/ │ Reusable components

├── layouts/ │ Page layouts

└── stores/ State management

Mihomo Rules

All Mihomo related code MUST be placed inside:

backend/internal/mihomo/

The Mihomo service layer is responsible for:

  • Starting Mihomo
  • Stopping Mihomo
  • Restarting Mihomo
  • Checking status
  • Reading logs
  • Calling Mihomo External Controller API

Do not directly execute Mihomo commands inside API handlers.

Example:

Correct:

API Handler | ↓ Mihomo Service | ↓ Mihomo Core

Incorrect:

API Handler | ↓ Execute mihomo command directly

Configuration Rules

Mihomo configuration must be generated through templates.

Do not manually concatenate YAML strings.

Configuration flow:

Database

↓

Config Generator

↓

YAML Template

↓

config.yaml

↓

Mihomo Reload

Database Rules

Use GORM models.

Main tables:

users

  • id
  • username
  • password_hash
  • role
  • created_at

listeners

  • id
  • name
  • type
  • listen
  • port
  • enabled
  • config

listener_users

  • id
  • listener_id
  • username
  • password

subscriptions

  • id
  • user_id
  • token
  • format
  • expire_time

configs

  • id
  • name
  • content

API Rules

All APIs use:

/api/v1/

Example:

GET:

/api/v1/mihomo/status

POST:

/api/v1/listeners

DELETE:

/api/v1/listeners/:id

Frontend Rules

Use Ant Design components.

Keep pages separated.

Do not put business logic directly inside components.

Use:

API Layer

↓

State Store

↓

Components

Security Rules

Never store plaintext passwords.

Use password hashing.

Validate all user input.

Do not expose sensitive system information.

Do not allow arbitrary command execution from Web UI.

Development Rules

Before implementing a large feature:

  1. Explain the design
  2. Confirm database changes
  3. Confirm API changes
  4. Then write code

Keep the project modular.

Avoid unnecessary dependencies.

Prefer simple and maintainable solutions.

Future Features

The architecture should allow adding:

  • Traffic statistics
  • Multiple Mihomo instances
  • Multi-user management
  • Docker deployment
  • Cluster management
Reference in new issue View Git Blame Copy Permalink