nano /etc/nginx/sites-available/213awsdasd.topnano /etc/nginx/sites-available/yourdomain170.top
map $http_upgrade $connection_upgrade { default upgrade; '' close; }

# Порт 80: только проверка Let's Encrypt и редирект на https
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
    location /.well-known/acme-challenge/ { root /var/www/acme; }
    location / { return 301 https://yourdomain170.top$request_uri; }
}

# Сайт-заглушка + панель и подписка по секретным путям
#  8001/8002 — сюда Xray отдаёт «чужой» трафик (вариант А, TLS уже снят Xray)
#  8443      — сюда смотрит Reality (вариант Б, здесь TLS с сертификатом домена)
server {
    listen 127.0.0.1:8001 proxy_protocol;
    listen 127.0.0.1:8002 http2 proxy_protocol;
    listen 127.0.0.1:8443 ssl http2 proxy_protocol;
    server_name yourdomain170.top;

    ssl_certificate     /root/cert/yourdomain170.top/fullchain.pem;
    ssl_certificate_key /root/cert/yourdomain170.top/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    set_real_ip_from 127.0.0.1;
    real_ip_header proxy_protocol;
    server_tokens off;
    absolute_redirect off;

    root /var/www/yourdomain170.top;
    index index.html;

    # Панель 3x-ui
    location /TDZ1ZUwOBCU8t3wLgJ/ {
        proxy_pass https://127.0.0.1:47822;
        proxy_ssl_verify off;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }

    # Подписка 3x-ui
    location /5wv0nkesr7bb42fv/ {
        proxy_pass https://127.0.0.1:2096;
        proxy_ssl_verify off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto https;
    }

    location / { try_files $uri $uri/ =404; }
}