Service Comments Discussion
If you run XUI.one or Xtream UI and you have resellers, you already know the hole in the setup.
Every reseller you add is one more account that can reach your main server. One careless login, one password shared around, one reseller who sells his access on, and your whole database is somebody else's problem. And when it happens, good luck reconstructing who changed what.
I built Nexus Panel to close that.
It is a separate panel on its own VPS. Your resellers log into that box, not into XUI. The panel is the only thing that talks to your panel database, and it goes through an SSH tunnel: the database port on your main server never has to face the internet, and the key the installer puts there can do nothing but that one forward. No shell, no command. Resellers never touch the main server. Not through the panel, not around it.
What a reseller can do
What you keep as admin
Under the hood
Install
One-click installer, English or German. It asks for your domain, the address of your main server and the database user, works out by itself whether XUI.one or Xtream UI is running there, and sets up the web server, the database, the Let's Encrypt certificate, UFW and Fail2ban on its own. It also creates the tunnel account on your main server and verifies it with a real tunnel before it continues. You log in with the admin credentials you already have. No extra account, no migration, nothing to move.
A 1 GB VPS is enough to start. Your existing XUI install stays exactly as it is.
Running it
Updates are one button in the settings: the panel tells you when a newer build is out, updates itself and the part on your main server, and rolls the whole thing back on its own if anything fails. If something does break, you report it from inside the panel. A technical diagnosis is attached, with passwords and keys stripped out, and my reply lands in the same screen.
14 days free. Full version, no limits, no payment details up front. Put it on a VPS, point it at your XUI box, hand it to a couple of resellers and watch how it behaves. If it does not fit your setup, you stop and owe nothing.
Every reseller you add is one more account that can reach your main server. One careless login, one password shared around, one reseller who sells his access on, and your whole database is somebody else's problem. And when it happens, good luck reconstructing who changed what.
I built Nexus Panel to close that.
It is a separate panel on its own VPS. Your resellers log into that box, not into XUI. The panel is the only thing that talks to your panel database, and it goes through an SSH tunnel: the database port on your main server never has to face the internet, and the key the installer puts there can do nothing but that one forward. No shell, no command. Resellers never touch the main server. Not through the panel, not around it.
What a reseller can do
- Create, extend and disable their own customer lines
- Reset their customers' passwords
- Assign bouquets
- Create trial lines
- See their own credit balance and their own action log
What you keep as admin
- Create, edit and disable resellers
- Assign credits
- See and manage every line from every reseller
- Full audit log and login log
- Permission groups, so you decide per reseller what they may touch
Under the hood
- HTTPS only, TLS 1.2 / 1.3
- JWT auth, 1 hour access token, 7 day refresh
- Two-factor login (TOTP) with backup codes, and every signed-in session revocable
- Panel to main server over an SSH tunnel, database port stays closed
- Rate limiting: 5 login attempts per minute, 30 API requests per minute per IP
- Fail2ban blocks IPs after repeated failures
- Every SQL query parameterised
- HSTS, X-Frame-Options, X-Content-Type-Options
Install
One-click installer, English or German. It asks for your domain, the address of your main server and the database user, works out by itself whether XUI.one or Xtream UI is running there, and sets up the web server, the database, the Let's Encrypt certificate, UFW and Fail2ban on its own. It also creates the tunnel account on your main server and verifies it with a real tunnel before it continues. You log in with the admin credentials you already have. No extra account, no migration, nothing to move.
A 1 GB VPS is enough to start. Your existing XUI install stays exactly as it is.
Running it
Updates are one button in the settings: the panel tells you when a newer build is out, updates itself and the part on your main server, and rolls the whole thing back on its own if anything fails. If something does break, you report it from inside the panel. A technical diagnosis is attached, with passwords and keys stripped out, and my reply lands in the same screen.
14 days free. Full version, no limits, no payment details up front. Put it on a VPS, point it at your XUI box, hand it to a couple of resellers and watch how it behaves. If it does not fit your setup, you stop and owe nothing.