obscuremind
4566ecbd52
Plan section 9, R1 `settings`: API nodes log unknown-key reads to
`audit.settings_misses`. Once a node's replica owns its settings, a key
outside lb_settings_keys.php is absent there, and the CI scan behind the
allowlist cannot see a key built at run time. The count names such reads
before they fail.
On the node (Core/Cluster/SettingsAudit): in mode 1 or 2, as the agent's
flows.json says (NodeFlows::declared, no database and no servers read),
each read through SettingsManager's getters (get, getBool, getInt,
getString, getArray, has) of a key outside the allowlist's `keys` and
`withheld` is counted. A process keeps its counts in memory and merges
them at exit, and every minute while it runs, into a per-day file under
its lock (STORAGE_PATH/cluster/settings_misses/YYYYMMDD.json). It then
writes config/cluster/audit.json, `{"settings_misses": {key: count}}`
over the last seven UTC days, which the agent is to send as the
heartbeat's `audit`. Everything is bounded: 64 names, the rest and any
key that is not a settings name under "*". cron:cleanup prunes the day
files after eight days and rewrites audit.json every hour, so old days
drop out; in mode 0 the file is removed. MAIN and legacy nodes have no
flows.json and count nothing; a read costs one lookup.
On MAIN (Domain/Cluster/NodeAudit): a heartbeat's `audit` is normalised
(names and positive integer counts only, at most 16 KiB, the least
missed past 64 names folded into "*") and kept in the new
cluster_nodes.audit (migration 045, mirrored in database.sql; 044 is taken
by work on another branch). It is written only when it differs from what
the row holds, which every request reads already, so an unchanged report
costs no query, on the cluster bus or not. A heartbeat without `audit`,
today's agent's, changes nothing. The Cluster Nodes page shows each mode 1
or 2 node's misses.
SettingsAuditTest covers the counting per getter, withheld keys not
counted, mode 0 and MAIN counting nothing, the merge across processes,
the caps, the seven-day window, the pruning, the empty report and the
minute's merge of a long-running process. ClusterApiTest covers the
heartbeat storing a report once, an unchanged, missing or malformed one
writing nothing, an empty one clearing the page, and the cap; and
ReplicaBootTest a child process's miss reaching audit.json at its exit,
while booting from the replica reads only allowlisted settings.
XC_VM IPTV Panel
Open-source, community-driven Xtream Codes panel
Built for modern IPTV workflows – powerful, scalable, and free.
📑 Table of Contents
📘 Contents
🚀 Overview
XC_VM is an open-source IPTV platform based on Xtream Codes. It enables:
- 📺 Live & VOD streaming
- 🔀 Load balancing
- 📊 Full user/reseller control
- 🎚️ Transcoding & EPG
- 🔐 Hardened security fixes
✅ 100% free. No license checks. No server locks.
⚠️ Status
BETA SOFTWARE — actively developed
📚 Documentation
-
🇬🇧 English Guide https://vateron-media.github.io/XC_VM/
-
🇷🇺 Руководство на русском https://vateron-media.github.io/XC_VM/ru/
🔄 Migration Guide
Migrating from Xtream Codes / XUI.one? Follow the step-by-step migration guide:
- 📖 Migration Guide https://vateron-media.github.io/XC_VM/info/migration_guide/
🧱 Technology Stack
| Component | Version | Description |
|---|---|---|
| PHP | 8.1.33 | Backend runtime |
| Nginx | 1.24 | Web server & reverse proxy |
| FFmpeg | 8.0, 7.1, 4.0 | Media transcoding & processing |
| MariaDB | 11.4 | SQL database engine |
| KeyDB | 6.3.4 | Cache & session storage (Redis) |
🐧 Supported Operating Systems
XC_VM supports multiple Linux distributions. Distribution-specific binaries (PHP, Nginx) are downloaded automatically from XC_VM_Binaries during installation.
Ubuntu
| Version | Codename | Status |
|---|---|---|
| 20.04 | Focal Fossa | ⚠️ Outdated — installation possible, but some packages may need to be installed manually |
| 22.04 | Jammy Jellyfish | ✅ Recommended |
| 24.04 | Noble Numbat | ✅ Recommended |
Debian
| Version | Codename | Status |
|---|---|---|
| 11 | Bullseye | ✅ Supported |
| 12 | Bookworm | ✅ Recommended |
| 13 | Trixie | ✅ Supported |
RHEL-compatible (Rocky Linux, AlmaLinux, CentOS, RHEL)
| Version | Status |
|---|---|
| 8 | 🚧 Not yet supported |
| 9 | 🚧 Not yet supported |
⚠️ RHEL-family support is planned but not yet available. The installer recognizes these distributions, but pre-built binaries are not provided yet.
💡 Recommendations
For new installations:
- 🟢 Ubuntu 22.04 / 24.04 LTS
- 🟢 Debian 12
⚠️ Ubuntu 18.04 is in legacy mode — it works but receives no priority fixes.
📥 Quick Install
✅ Ubuntu 22.04+, Debian 11+
# 1. Update system
sudo apt update && sudo apt full-upgrade -y
# 2. Install dependencies
sudo apt install -y curl wget python3 unzip
# 3. Download latest release
latest_version=$(curl -s https://api.github.com/repos/Vateron-Media/XC_VM/releases/latest | grep '"tag_name":' | cut -d '"' -f 4)
wget "https://github.com/Vateron-Media/XC_VM/releases/download/${latest_version}/XC_VM.zip"
# 4. Unpack and install
unzip XC_VM.zip
sudo python3 install
🧪 Beta Install
To install the latest beta (pre-release) version:
# 1. Update system
sudo apt update && sudo apt full-upgrade -y
# 2. Install dependencies
sudo apt install -y curl wget python3-pip unzip
# 3. Download latest beta release
beta_version=$(curl -s https://api.github.com/repos/Vateron-Media/XC_VM/releases | grep -m1 '"tag_name":' | cut -d '"' -f 4)
wget "https://github.com/Vateron-Media/XC_VM/releases/download/${beta_version}/XC_VM.zip"
# 4. Unpack and install
unzip XC_VM.zip
sudo python3 install
⚠️ Beta versions may contain unstable features. Use on test servers only.
🧰 Service Management
sudo systemctl start xc_vm # Start
sudo systemctl stop xc_vm # Stop
sudo systemctl restart xc_vm # Restart
sudo systemctl status xc_vm # Status
sudo /home/xc_vm/bin/nginx/sbin/nginx -s reload # Reload Nginx config
journalctl -u xc_vm -f # Live logs
🔍 Troubleshooting — Panel Won't Start
If the panel fails to start, check the following logs and commands:
Nginx error log:
cat /home/xc_vm/bin/nginx/logs/error.log
PHP-FPM log:
cat /home/xc_vm/bin/php/var/log/php-fpm.log
Verify PHP binary works:
/home/xc_vm/bin/php/bin/php -v
If PHP fails to run, the panel cannot start at all — fix PHP issues first before investigating Nginx.
📂 Project Structure
├─ docs/ # 📚 Project documentation
├─ lb_configs/ # ⚙️ Configurations for building Load Balancer (LB)
└─ src/ # 💻 Main project code
🧮 Server Requirements & Sizing
🔧 Minimum Specs
| Component | Recommendation |
|---|---|
| CPU | 6+ cores (Xeon/Ryzen) |
| RAM | 16–32 GB |
| Disk | SSD/NVMe, 480+ GB |
| Network | Dedicated 1 Gbps port |
| OS | Ubuntu 22.04+, Debian 12+ (clean install) |
📊 Planning Formulae
- Bandwidth (Mbps) = Channels × Bitrate
- Max Users = Bandwidth ÷ Stream Bitrate
Example:
HD bitrate = 4 Mbps
1 Gbps = ~940 usable Mbps
→ Max Channels: 940 ÷ 4 = ~235
→ Max Users: 940 ÷ 4 = ~235
⚠️ 10 users watching the same channel = 10× bandwidth (unless caching or multicast used)
💻 RAM & CPU Usage
| Resource | Load per Stream |
|---|---|
| RAM | 50–100 MB |
| CPU (transcoded) | ~1 core |
✅ Features
- ✅ No server restrictions
- ✅ EPG importer
- ✅ VOD management
- ✅ User/reseller panel
- ✅ Security patches
- ✅ Clean UI
🔧 Known Limitations
- ❌ Requires Linux knowledge
- ❌ Community-based support
- ❌ Some bugs in transcoding module (in progress)
🤝 Contributing
We welcome community help!
⚠️ Legal & Project Independence Notice
XC_VM is an independent software project and is not affiliated with or endorsed by XUI.one.
All backend systems, core logic, and infrastructure of XC_VM have been independently developed without using source code from XUI.one or related projects.
The administrative interface (UI/UX) is inspired by general industry practices and partially by XUI.one in terms of usability concepts only. No proprietary source code or protected assets have been intentionally reused.
📜 License Enforcement (AGPL-3.0)
XC_VM is distributed under the GNU Affero General Public License v3.0 (AGPL-3.0).
Under this license:
- Redistribution or modification is permitted only under the same license (AGPL-3.0)
- Any modified version must remain open-source
- Providing XC_VM as a service requires making the source code available
- Copyright and attribution must be preserved
Any attempt to redistribute this software under a different license, remove attribution, or obscure the origin of the project constitutes a violation of the license terms.
Attribution-integrity check
As permitted by AGPL-3.0 §7(b) (preservation of author attributions), the panel
verifies on each request that its attribution notice — the "Vateron Media · AGPL-3.0"
credit shown in the panel footer — is still present. If the notice has been removed, the
management UI (admin / reseller / player panels) is locked with an
ATTRIBUTION_REMOVED notice until it is restored. The check is fully reversible and
non-destructive: no data is modified, the CLI remains available, and restoring the notice
unlocks the panel on the next request. End-viewer streaming is not affected by this check.
Each build is also stamped with a unique build identifier (XC_VM_BUILD_ID) for provenance,
so a leaked or rebranded copy can be traced back to the build it originated from.
White-label activation (dual-licensing)
Keeping the attribution notice means AGPL-3.0 — free, and everything works, including load-balancer nodes. If the attribution is removed (white-labelling), the panel requires a free, machine-bound activation key to provision load-balancer / cluster nodes; a single-server panel still runs locally without one. Keys are issued free and self-service (one per HWID, shown in Settings → Info and on the dashboard) and are revocable — this is accountability against rebranded resale, not monetization.
What the panel sends (full transparency)
A community install (attribution intact) never contacts the licensing server. A
white-label install contacts https://www.xcvm.tech only to: (a) obtain its key
(install_id), (b) run a weekly revocation check (jti + nonce), and (c) send one daily
check-in (install_id, jti, env_fp, nonce) recording which IP a HWID runs from —
evidence against a leaked copy. Every response is Ed25519-signed and verified. No
stream data, viewer data, credentials, database or file contents, and no remote command
channel are ever involved. Full detail:
Licensing & Activation.
⚖️ You are solely responsible for how it is used. We take no responsibility for misuse or illegal deployments.