System Components
Repositories
| Component | Repository | Image |
|---|---|---|
| Panel (API + web interface) | xray-panel/backend | ghcr.io/xray-panel/backend |
| Node | xray-panel/node | ghcr.io/xray-panel/node |
| Subscription page | xray-panel/subscription-page | ghcr.io/xray-panel/subscription-page |
| Deployment | xray-panel/deploy | compose files and nginx configs |
The panel frontend is built into the backend image (frontend-dist inside the
container), so no separate container is needed for the interface.
Panel
- HTTP API and web interface on
APP_PORT(3000 by default; exposed to the outside only through a reverse proxy). - PostgreSQL — the main data store. Container
xpanel-db. - Valkey (Redis-compatible) — queues, cache, pub/sub. Container
xpanel-redis. - Prometheus metrics on
METRICS_PORT(3001 by default), protected by basic auth fromMETRICS_USER/METRICS_PASS.
The panel is the only component that stores personal data.
Node
The node has no database and does not connect to the panel itself. The panel
reaches it on NODE_PORT (2222 by default) with mutual TLS and JWT. Hence an
important consequence: NODE_PORT must be reachable from the panel server,
not from the administrator's browser.
What the node stores and what it talks to:
- no user data is written to disk — only Xray logs in
/var/log/xray(capped at 10 MB, no archives); - a set of client UUIDs is kept in memory to detect configuration changes;
- there are no outgoing connections to the panel — inbound only;
- the only outgoing request that carries user data is the torrent-blocker webhook, and only if it is enabled in the plugin.
Subscription page
A separate container that reads data from the panel with an API token and serves the
end user a branded list of connections. It runs on APP_PORT (3010 by default);
exposed to the outside on a separate subdomain with HTTPS.
The variable names REMNAWAVE_PANEL_URL and REMNAWAVE_API_TOKEN are kept for
compatibility: this way the subscription page also works with an older panel.
Ports
| Port | Component | Access |
|---|---|---|
| 3000 | panel | 127.0.0.1 only, exposed through nginx |
| 3001 | panel metrics | 127.0.0.1 only |
| 3010 | subscription page | 127.0.0.1 only, exposed through nginx |
| 2222 | node | reachable from the panel server |
| any | Xray proxy | open to clients |
License and attribution
XLADA is distributed under AGPL-3.0-only and is a derivative work of Remnawave. Section 13 of the AGPL requires that users of the service can obtain the source code: make sure a link to the organization's repositories is available to your users.