SideRail on GitHub (icubaby/SideRail)

SideRail README

Protocols Transports

A bold, neobrutalist VPN control panel — powered by and shipped to in one click.

Clean client links. Live stats. Gorgeous subscription pages. No config, no fuss.

[!TIP] Fork → Deploy on Railway → Expose port 8080 → Open the panel. Four steps, zero config, live in minutes.

One job, done right

No feature bloat. SideRail masters HTTP-based transports behind a TLS edge — every link is clean, standard, and always security=tls on port 443.

Impossible to ignore

A loud neobrutalist UI — thick borders, hard shadows, animated icons — that looks razor-sharp on phone and desktop alike.

Deploy and forget

Xray-core pulls itself on first boot, the session secret is generated for you, and the DB just works. Zero environment variables required.

Team-friendly

The Owner adds Admins with scoped page access and personal data quotas — and every Admin only ever sees the users they created.

Dashboard	Live CPU, RAM, Swap and Storage metrics, plus one-click Backup & Restore of users, inbounds, admins and settings.
Users	Rich create form, summary cards, a fully responsive table, live Connected IPs, and per-user actions.
Inbounds	Five HTTP inbounds auto-seeded on first boot. Enable or disable only, each with a unique port and `/SideRail/...` path.
Activity Log	A live timeline of every administrative event.
Settings & Admins	Owner and Admin roles, scoped permissions, and per-admin data quotas.
Subscription	A gorgeous per-user page with a live usage chart, QR codes and a base64 subscription for clients.
Security	JWT sessions, built-in rate limiting, and sniffing fully disabled to prevent the QUIC crash.

No code required. Just follow these steps:

1. Fork this repository — click Fork at the top-right to copy it to your GitHub account.

2. Create a Railway project — head to , then New Project → Deploy from GitHub repo, and pick your fork.

3. Deploy — Railway reads the Dockerfile and railway.json and builds automatically.

4. Expose port 8080 — open Settings → Networking → Generate Domain, and set the port to 8080.

[!IMPORTANT] SideRail listens on port 8080 — this is the only port you expose. The ports 10085 and 20000–20004 are Xray's internal ports bound to 127.0.0.1; they are private and must not be exposed.

5. Add a volume (optional) — attach a Volume at /data so users, admins and settings survive redeploys.

6. Open your panel — visit the generated *.up.railway.app domain, land on the Setup page, and create your Owner account.

All optional.

Variable	Default	Description
`PORT`	`8080`	HTTP port. Expose this one on Railway.
`JWT_SECRET`	auto	Signs admin session cookies. Auto-generated and persisted if unset.
`XRAY_VERSION`	`v26.9.9`	Xray-core release fetched on first boot.
`SIDERAIL_DATA_DIR`	`/data`	Persistent data directory (mount a volume here).
`PUBLIC_DOMAIN`	auto	Override for a custom domain. Falls back to `RAILWAY_PUBLIC_DOMAIN`.
`XRAY_API_PORT`	`10085`	Internal Xray stats API port.
`XRAY_INBOUND_BASE_PORT`	`20000`	Base port for internal inbound listeners.

apps/
├─ web/           React + Vite + Tailwind (neobrutalism) frontend
│  └─ src/
│     ├─ components/ui/   Reusable neobrutalist primitives
│     ├─ pages/           Dashboard · Users · Inbounds · Activity · Settings · Setup · Login · Subscription
│     └─ lib/             API client, auth context, helpers
└─ server/        Express + Node (node:sqlite) backend
   └─ src/
      ├─ xray.ts          Binary fetch, process manager, traffic stats, client IPs
      ├─ xray-config.ts   Config builder (sniffing fully disabled)
      ├─ tunnel.ts        WS/HTTPUpgrade via net.Socket, XHTTP via http-proxy
      ├─ links.ts         VLESS/VMess/Trojan link generation
      ├─ inbounds.ts      Default inbound seeding + enable/disable
      ├─ users.ts         User model, traffic reset, sub-token logic
      ├─ auth.ts          Owner/Admin roles, permissions, sessions
      ├─ ratelimit.ts     Rate limiting / brute-force protection
      └─ routes.ts        Authenticated REST API

How traffic flows — TLS is terminated at the Railway edge; all client links use security=tls on port 443. The Node process routes WebSocket/HTTPUpgrade to Xray via raw net.Socket, and XHTTP through an HTTP proxy. Only ws, httpupgrade and xhttp are supported — raw TCP, gRPC, WireGuard and Hysteria are intentionally left out because they don't survive the edge.

Requires Node.js ≥ 22.5 (Node 24 recommended).

npm install     # install all workspaces
npm run dev     # web on :5173, server on :8080 (proxied)

npm run build   # production build (web + server)
npm start       # serve API + built frontend on :8080

Countless late nights and a lot of coffee went into this. If SideRail powers your setup, a small crypto tip goes straight back into keeping it fast, secure and free for everyone.

	`bc1qx48j9lj989y5c9z8ewpgul2ed69mr50j97a0sk`
	`0xF2ba522fD846F83D84131D433f56F885740cFc47`
	`ltc1qh6y8ld27fdleuy3r7gykxxg38rkawl7adzc0dw`
	`UQBGN4jXPW44cWQ20EGWqX7sU6K4RlYbnolc3IHoT3UWtmvW`

It is published for transparency and personal self-hosting only. You are welcome to fork and run your own instance, but the following are strictly prohibited without prior written permission:

Selling, reselling, or offering SideRail (or any derivative) as a paid product or service.
White-labeling or re-branding it under another name.
Removing or altering the icubaby / SideRail attribution, branding, logos, repository links, or the embedded authorship watermarks.
Claiming authorship of the project.

The source code carries embedded authorship identifiers and watermarks used to prove origin.

586 ·GitHub

SideRail

What is this?

SideRail is a neobrutalist web control panel for Xray-core VPN servers that you deploy to Railway with one click, giving you clean client links, live stats and subscription pages without manual config.

Is this a hosted service or something I run myself?

It is self-hosted: you fork the repo and deploy your own instance on Railway (or any Docker host) — SideRail is not a SaaS you sign up for.

How do I get it running?

Fork the repo, create a Railway project from your fork, let Railway build the included Dockerfile automatically, then expose port 8080 and open the generated domain to create your Owner account.

Do I need to configure Xray or set environment variables myself?

No — Xray-core downloads itself on first boot and the session secret auto-generates, so every environment variable is optional. Running outside Docker needs Node.js 22.5+ (Node 24 recommended), but Railway's Dockerfile handles that for you.

Which VPN protocols does it actually support?

Only HTTP-based transports behind a TLS edge — WebSocket, HTTPUpgrade and XHTTP, always on port 443. Raw TCP, gRPC, WireGuard and Hysteria are intentionally left out because they don't survive the Railway edge.

Can I resell or white-label this panel?

No — SideRail is proprietary software. You can fork it and self-host it for personal use, but selling it, white-labeling it, or removing the embedded attribution and watermarks is strictly prohibited.

What does the admin dashboard show?

Live CPU, RAM, Swap and Storage metrics, plus one-click Backup and Restore covering users, inbounds, admins and settings.

How do multiple admins work?

The Owner can add Admins with scoped page access and personal data quotas; each Admin only ever sees the users they personally created.

What do users get on their subscription page?

A per-user page with a live usage chart, QR codes and a base64 subscription link that VPN clients can import directly.

Will my data survive a redeploy?

Only if you attach a Railway Volume at /data — that is optional but keeps users, admins and settings persistent across redeploys.

What are similar projects?

nyx, SuperJinX, RVG, v2ray-agent, V2rayU, v2ray, Xray-core, Open-Box

Which topics is it in?

xray-core, rate-limiting, xray, vmess, vless, trojan, qr-code, jwt, admin-dashboard, backup, tls, vpn

Creator: icubaby
Size: 0.3 MB
Stars: 586
Updated: CommitOct 11 Releasev3.0.0Oct 11
Age: 27d
Commits · 90 Days

SideRail README

SideRail (icubaby/SideRail)