Configuration

English | 简体中文

Panel Settings overview

Open Panel Settings from the left sidebar. The page is divided into General, Authentication, Subscription, and Multi-control tabs.

The action bar has two separate operations:

• Save writes the settings.
• Restart Panel rebuilds the panel listeners and applies changes such as panel address, port, URI path, and TLS certificate.

Important

Saving settings and restarting Mihomo are different operations. Panel settings affect the m-ui process; inbound and Mihomo Settings changes normally require Restart Mihomo.

General

Remark model

The remark model determines generated node names. Select Inbound and Email/Username tokens and a separator. The preview shows the result before saving.

Panel listen address

• Listen IP is the local address on which m-ui binds. 0.0.0.0 listens on all IPv4 interfaces; a specific address restricts the listener.
• Listen Domain is a public hostname used when m-ui composes subscription URLs. It is not a bind address and must not include http://, https://, a port, or a path.
• Listen Port must be an unused TCP port from 1 to 65535.
• URI Path hides the panel below a URL prefix such as /a-long-random-value/. The path must begin and end with /.

After changing the panel port or URI path, save the new URL before restarting. The current browser address stops working after the restart.

Sessions, pagination, and language

• Session Duration is measured in minutes and must be at least 60.
• Pagination Size controls the Inbounds table; 0 disables pagination.
• Language supports Simplified Chinese and English.

Notifications

Expiration and traffic-cap thresholds control the warning state shown by the panel. They do not send Telegram or email messages. Set a threshold to 0 to disable that warning.

Certificates

Set both the certificate chain and private-key paths. They must be readable by the m-ui service and must form a valid TLS key pair. Save and restart the panel to enable HTTPS.

Recommended paths for certificates managed by the installer are:

/root/cert/<domain>/fullchain.pem
/root/cert/<domain>/privkey.pem

Use m-ui ssl for issuance, renewal, revocation, listing, and path configuration. See Cloudflare WARP for DNS validation when port 80 is unavailable.

External traffic callback

External Traffic Inform enables HTTP notifications to the configured URI when traffic is updated. Only enable it for an endpoint you control. The URI must be a complete http:// or https:// URL.

Date and time

Choose an IANA time-zone name or Local. Client expiry displays and scheduled traffic resets use this setting. Synchronize the server clock with NTP, especially when Multi-control is enabled, because peer messages have a limited validity window.

Mihomo core

Setting	Purpose
Core Path	Absolute path to the Mihomo executable. The installer uses /usr/local/m-ui/mihomo.
API Address	Local Mihomo external-controller address. Keep it on loopback unless you understand the exposure.
API Secret	Bearer secret used by m-ui to access the controller.
Mixed Port	Default Mihomo mixed-port. It must not conflict with the panel, subscription, API, or inbound ports.
Mode	rule, global, or direct.
Log Level	Mihomo logging level.
Allow LAN	Allows LAN access to Mihomo's default proxy listener.

The default installer core path, controller address, and mixed port are:

/usr/local/m-ui/mihomo
127.0.0.1:9093
12080

Authentication

Open Panel Settings → Authentication. Enter the current username and password, then the new credentials. Authentication changes require the current credentials so an existing browser session cannot silently replace the administrator account.

The Linux management script can recover credentials from a terminal:

m-ui reset-credentials

Leaving the new username or password blank in that terminal flow generates a random value.

Subscription settings

The Subscription tab manages the service port, normal path, cross-panel path, client suffixes, and per-Username tokens. It is documented separately in Subscriptions.

Multi-control settings

The Multi-control tab stores a peer identity and pairing information separately from normal panel settings. See Multi-control and Cross-panel Features.

Reverse proxy

Nginx example

The safest arrangement is to bind m-ui to loopback and terminate TLS at Nginx. This example assumes m-ui listens on 127.0.0.1:2053:

server {
    listen 443 ssl http2;
    server_name panel.example.com;

    ssl_certificate     /etc/letsencrypt/live/panel.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/panel.example.com/privkey.pem;

    location / {
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_pass http://127.0.0.1:2053;
    }
}

Forward the entire panel listener rather than only the visible URI path. Multi-control uses fixed root-level paths under /_m-ui/peer/ and does not pass through the hidden panel prefix.

If a dedicated subscription port is enabled, either expose that port directly or create another reverse-proxy location/server for it. The dedicated subscription listener does not serve panel APIs or peer endpoints.

Caddy example

panel.example.com {
    reverse_proxy 127.0.0.1:2053
}

Set Listen Domain to panel.example.com. When TLS terminates at the proxy, the X-Forwarded-Proto and Host values determine the public subscription URL.

Security checklist

• Use HTTPS before exposing the login page publicly.
• Use a long, non-obvious panel URI path.
• Keep the controller address on loopback.
• Do not reuse the panel password as a client, API, or pairing secret.
• Restrict the panel port by firewall or reverse proxy where possible.
• Do not expose data/state.json or data/multi-control.json.
• Test a new panel URL in a second terminal/browser before closing the current administrative session.