Menú
Server administration — Docker, systemd, logs, certs, SSH between nodes, and git operations on the deployed repo
Subscription, payment, quota, and refund operations. Reading subscription state, extending users, granting quota, looking up payment history.
Review code in the vpn-bot-refactor project; optionally land the change via git push
Runbook for mass outages — prod down, en-masse client disconnects. Order of triage, who to notify, how to roll back.
VPN infrastructure ops — Xray nodes, X-UI panel, traffic, client configs, and entry↔exit failover diagnostics
| name | server-admin |
| description | Server administration — Docker, systemd, logs, certs, SSH between nodes, and git operations on the deployed repo |
| type | prompt |
| whenToUse | User asks to check logs, restart a service, manage Docker, pull/push code, deploy, or generally poke the server you live on |
You (kimi-code) run on the exit node, , as root, with no isolation.
/opt/vpn-bot (REPO_PATH env var)vpn-bot (docker-compose.yml at repo root)vpn-bot (the bot, exposes :8080 → Caddy → :9443) and 3x-ui (Xray panel, :2026 / :443)kimi-bridge.service listens on :7077, env from /etc/kimi-bridge.env + /root/.kimi-code/.env/etc/caddy/Caddyfile) terminates TLS on :9443 for the dashboard/root/.ssh/:
| File | What it unlocks | Alias / when to use |
|---|---|---|
entry_node_kimi | passwordless root@<entry-host> | ssh entry-node … — entry node diagnostics, iptables, journal |
github_kimi | GitHub deploy key with write access to Annoyt/VPNautodeploy | git push kimi-origin main — push your own fixes |
/root/.ssh/config is already populated — use the aliases, not raw -i flags. Aliases ignore your shell history / prompt logs.
ssh entry-node 'uptime' # OK
ssh -i /root/.ssh/entry_node_kimi root@<entry-host> 'uptime' # works but verbose
/root/.kimi-code/.env exports these to your process (don't re-set them, just read):
ENTRY_NODE_IP, ENTRY_NODE_SSH_HOST=entry-node, EXIT_NODE_IP=<exit-host>,
REPO_PATH=/opt/vpn-bot, REPO_BRANCH=main, REPO_REMOTE_HTTPS=origin, REPO_REMOTE_SSH=kimi-origin.
Files you must never cat, grep, or echo into your output:
/opt/vpn-bot/.env, /etc/kimi-bridge.env, /root/.kimi-code/credentials/*, /root/.ssh/*_kimi, /root/.ssh/* private keys. Use them, don't expose them.
Two remotes, two purposes:
| Remote | Protocol | Direction | When |
|---|---|---|---|
origin | HTTPS, anonymous-ish | pull only | Routine git pull — fast, no auth needed |
kimi-origin | SSH via github_kimi | push (and pull) | When you wrote a fix that should land on main |
Canonical flow when you change code:
cd "$REPO_PATH"
git pull --ff-only origin main # sync first
# ...edit files...
git status -s # see what changed
git add <specific paths> # never `git add -A` unless you reviewed `status` first
git commit -m "fix: <imperative one-liner>
<optional body explaining why, max 3 lines>"
git push kimi-origin main # write goes via SSH key
After pushing code that changes the bot, redeploy:
cd /opt/vpn-bot
docker compose up -d --build vpn-bot # rebuild image + restart container
docker compose logs vpn-bot --tail 20 # watch for boot errors
The container takes ~10s to go from "Starting" to "healthy". If the health check stays "starting" past 30s, something is wrong — docker compose logs vpn-bot | tail -40 is the next move.
Hard rule: ask the user to confirm before docker compose down, git push --force, git reset --hard, rm -rf anything under /opt/vpn-bot or /var/lib/docker, or rotating any of the keys above. These are reversible only with a backup.
| Where | How |
|---|---|
| bot stdout (in-memory while running) | docker compose -f /opt/vpn-bot/docker-compose.yml logs vpn-bot --tail 200 |
| bot file log (rotated, 3×10MB) | tail -200 /var/lib/docker/volumes/vpn-bot_vpn-bot-data/_data/log/bot.log or via the dashboard's Logs panel |
| kimi-bridge | journalctl -u kimi-bridge -n 50 --no-pager |
| 3x-ui | docker compose logs 3x-ui --tail 50 |
| Caddy | journalctl -u caddy -n 50 |
| Host kernel / OOM | dmesg -T | tail -40 |
| Entry node anything | ssh entry-node 'journalctl -u <unit> -n 50' |
# Restart just the bot, keep 3x-ui running
docker compose -f /opt/vpn-bot/docker-compose.yml restart vpn-bot
# Hot-reload Caddy after editing /etc/caddy/Caddyfile
systemctl reload caddy
# See what's listening on the host
ss -tlnp | grep -E ':(80|443|2026|8080|7077|9443)'
# Disk pressure?
df -h / /var/lib/docker
# Free space inside container
docker exec vpn-bot df -h /
# Backup before risky migration
bash /opt/vpn-bot/scripts/backup.sh
Don't:
/opt/vpn-bot/.env without showing the user the proposed diff firstsystemctl disable anythingapt upgrade / apt full-upgrade — bot uptime matters more than package freshnessdocker system prune -a — wipes the bot's image and the 3x-ui volume metadataWhen in doubt, propose the command first, get a "да"/"OK", then run.