codebuddy
72cee0e85e
Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env.
3m-ui
Languages / 语言: README · English · 简体中文 · 繁體中文 · 日本語 · 한국어 · Español · Français · Deutsch · Русский · Português (Brasil) · Tiếng Việt · Bahasa Indonesia · ไทย · Türkçe · العربية · हिन्दी · Polski · Українська
Mihomo server web management panel
Stable first: install and update use formal releases by default. Pre-releases require an explicit choice. Full bundles and Docker images ship a pinned Mihomo core — see installation docs.
Lightweight and self-hosted. Manage Mihomo listeners, users, subscriptions, and runtime status on Linux.
Documentation: https://3m-ui.top/docs/ · Website
Features
| Area | Capabilities |
|---|---|
| Nodes | Protocol-registry listeners (VLESS / VMess / Trojan / Shadowsocks / Hysteria2 / TUIC / AnyTLS / Snell / ShadowQUIC, …); REALITY target scan; TLS self-signed certs; transport field validation |
| Users | Bind nodes, traffic/expiry, IP/HWID limits, start-on-first-use, cycle renew/reset, groups/tags, external sub merge, batch ops, subscription tokens |
| Subscriptions | UA routing for Clash/Mihomo YAML, v2ray Base64, sing-box JSON; optional ?target=; HTML info page |
| Config | Generate → validate → apply; rollback previous config.yaml on failure |
| Ops | Core start/stop/update, logs, dashboard, online connections, Geo, panel SSL/ACME, WARP one-click, backup/restore |
| Telegram | Alerts and bot commands (token + chat IDs) |
| Cluster | Register remote panels, health checks, node mirror sync, merged subscriptions |
Install
curl -fsSL https://raw.githubusercontent.com/kazeyukiro/3m-ui/main/scripts/install.sh | sudo sh
After install, update with:
sudo 3m-ui update
# sudo 3m-ui update v1.0.2
Default panel: http://SERVER_IP:8080/ — user admin, one-time random password printed at install (change on first login).
Install with an AI assistant prompt
Copy the prompt into ChatGPT / Claude / Cursor (and state your OS, e.g. Ubuntu 22.04, and whether you have root SSH). The assistant should only use the official installer — not rewrite URLs or invent third-party commands. The full prompt and usage notes live in the AI install prompt doc.
Skip manual copy-paste — load the plain-text prompt straight to your clipboard with curl:
curl -fsSL https://raw.githubusercontent.com/kazeyukiro/3m-ui/main/docs/ai-install-prompt.en.txt | pbcopy # macOS
curl -fsSL https://raw.githubusercontent.com/kazeyukiro/3m-ui/main/docs/ai-install-prompt.en.txt | xclip -sel clip # Linux X11
curl -fsSL https://raw.githubusercontent.com/kazeyukiro/3m-ui/main/docs/ai-install-prompt.en.txt | wl-copy # Linux Wayland
The prompt only ever runs the official one-liner below; all downloads verify SHA256SUMS:
curl -fsSL https://raw.githubusercontent.com/kazeyukiro/3m-ui/main/scripts/install.sh | sudo sh
For the optional pre-release / test channel, see installation docs.
Build from source
cd frontend && npm install && npm run build
cp -r dist ../backend/cmd/server/web/dist
cd ../backend && CGO_ENABLED=0 go build -tags sqlite_modernc -trimpath -ldflags='-s -w' -o ../3m-ui ./cmd/server
Static Linux binaries for multiple architectures are on Releases.
Acknowledgements
- Mihomo — core engine and listener model
- clashmeta-inbound — listener examples
- 3x-ui / s-ui — panel UX inspiration
- Gin, GORM, React, Ant Design, Zustand, golang-jwt/jwt
- Go, Node.js, and the open-source community
Contributors: Contributors
License
Third-party notices: THIRD-PARTY-NOTICES.md.