okooooooo/3m-ui
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
4dde61e8dbcc8402f4dc245de120f514b1a2dc21
3m-ui/docker-compose.yml
T
風雪 39608cd0fb fix(infra): fail-closed checksums, sandbox hardening, non-root Docker 
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain):
- C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256()
downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE
decompression. Mismatch is fatal.
- C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS
was missing or asset unlisted. Now fail-closed: err exit unless the
operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256
tooling is now a hard dependency.
- C-5: Downloaded binaries were executed as root (--version / -v) for
smoke-testing. Remove every invocation; rely on checksum + 'file'
ELF check instead.
- H-1: Drop raw.githubusercontent.com fallback for helper scripts.
Missing release asset now hard-fails (supply-chain posture).
Sandbox:
- H-2: systemd unit gains UMask=0077, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/
Modules/Logs, ProtectControlGroups, ReadWritePaths,
RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime,
RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native,
SystemCallFilter=@system-service ~@privileged @resources.
CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN.
- C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001),
pre-creates & chowns volumes, sets USER 10001:10001.
- M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080
(loopback-only by default; operator uses reverse proxy).
- M-9: docker-compose gains security notes (reverse-proxy guidance,
admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD
example, UID 10001 volume ownership).
- M-10: release.yml gains a TODO comment for cosign keyless signing.
- LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now
'Initial administrator: admin / admin. You MUST change the password
on first login.'
2026-08-29 09:39:25 +00:00

45 lines
1.7 KiB
YAML
Raw Blame History

# 3m-ui — Mihomo management panel (Ant Design frontend)
# Usage:
# docker compose up -d
# Panel: http://localhost:8080/ (bound to 127.0.0.1 by default)
#
# Security notes (M-3 / M-9):
# - The panel is bound to 127.0.0.1 only. Place a reverse proxy (nginx/Caddy/
# Traefik) in front for TLS termination and access control. To expose the
# panel directly (NOT recommended), replace the port mapping with "8080:8080".
# - Default administrator is admin/admin (forced password change on first
# login). For unattended installs, set THREE_M_UI_ADMIN_PASSWORD below.
# - Named volumes inherit UID 10001 (the non-root 3m-ui user) from the image on
# first creation. If you bind-mount host directories instead, chown them to
# 10001:10001 on the host.
services:
3m-ui:
build: .
image: 3m-ui:local
container_name: 3m-ui
restart: unless-stopped
ports:
# M-3: bind loopback only by default. Use a reverse proxy for public access.
- "127.0.0.1:8080:8080"
environment:
THREE_M_UI_CONFIG: /etc/3m-ui/config.yaml
TZ: Asia/Shanghai
# M-9: default admin is admin/admin (forced change on first login).
# Uncomment and set to override the initial password for unattended installs:
# THREE_M_UI_ADMIN_PASSWORD: change-me-before-deploy
volumes:
- 3m-ui-config:/etc/3m-ui
- 3m-ui-data:/var/lib/3m-ui
- 3m-ui-logs:/var/log/3m-ui
# Optional: share host Mihomo binary + config
# - /usr/local/bin/mihomo:/usr/local/bin/mihomo:ro
# - /etc/mihomo:/etc/mihomo
# First run: create a minimal config if missing (via entrypoint override or mount).
# Generate secrets yourself — do not use example values in production.
volumes:
3m-ui-config:
3m-ui-data:
3m-ui-logs:
Reference in new issue View Git Blame Copy Permalink