🎉 Nginx UI v3 is here. It is the biggest change since v2: Nginx UI now runs plugins. DNS providers, notifications, backup storage, certificate deployment and more can come from plugins you install from a signed marketplace, while log analytics is rebuilt from the ground up and stays built in.
❤️ Thank you to everyone who tested the v3 branch, and to @Hintay, who designed and built the plugin system.
✨ Highlights
🧩 Plugin system
- Install, update and remove plugins from the Plugins page, from the official marketplace or catalogs of your own, or upload an offline package.
- Plugins can add DNS-01 providers, pages, notifications, probes, MCP tools, backup storage, certificate deployment, content and log sinks.
- Each plugin runs in its own process. A plugin that crashes is restarted and, if it keeps crashing, stopped, without taking Nginx UI down with it. On Linux, the system stops a plugin before Nginx UI when memory runs out, and with cgroup v2 plugins run under memory and CPU limits.
- Plugins ask for the permissions they need and say why. An update that asks for more waits for your approval, and plugins are kept in sync across cluster nodes.
📦 A lighter core
Moving the DNS providers out of the core makes every installation smaller, and lets the providers update on their own:
| v2.9.5 | v3.0.0 | ||
|---|---|---|---|
| Binary (linux/amd64) | 142.4 MB | 100.2 MB | −30% |
Download (nginx-ui-linux-64.tar.gz)
| 45.4 MB | 33.7 MB | −26% |
| Go module dependencies | 361 | 205 | −43% |
- Only a node that issues DNS-01 certificates installs the DNS-01 plugin (19.6 MB for linux/amd64), with all 222 providers lego supports.
- New providers and provider fixes ship as plugin releases from the marketplace, without waiting for a new Nginx UI version.
🛒 Official marketplace and Developer Center
- The official marketplace at plugins.nginxui.com is built in. Every package is signed, and each plugin shows its trust level: official, verified partner or community.
- The marketplace shows screenshots, why a plugin needs each permission, release notes, beta channels and earlier versions, and tells you when an installed version was withdrawn or a plugin was taken down.
- Plugin authors submit and manage their listings in the Developer Center.
🌐 DNS-01 becomes an official plugin
- The DNS providers move into the official DNS-01 plugin, installed automatically on nodes that issue DNS-01 certificates. The Docker image bundles it, so containers keep renewing without a download.
- The main node can issue DNS-01 certificates for other nodes.
📊 Log analytics, rebuilt on a column store
Bleve, a full-text search engine, kept one document per log line with an index on almost every field. Log analytics only ever filters by time, value or substring and then counts, groups or pages, so v3 stores parsed logs in a column store built for exactly that: dictionary-encoded, zstd-compressed columns in blocks the queries can skip by time range.
On 100k combined-format log lines (Apple M5 Pro):
| v2 (Bleve) | v3 (column store) | ||
|---|---|---|---|
| Index on disk per line | 1508 B (8.6× the raw log) | 28.5 B (0.16× the raw log) | 53× smaller |
| Indexing CPU per line | 134 µs | 0.98 µs | 136× faster |
| Memory allocated while indexing | 9.2 GB | 216 MB | 42× less |
| Log viewer page | 1479 ms | 19.9 ms | 74× faster |
| Dashboard browser, OS and device charts | 75.8 ms | 0.56 ms | 135× faster |
| Dashboard top 100 URLs | 64.7 ms | 5.7 ms | 11× faster |
| World map | 84.1 ms | 0.31 ms | 275× faster |
The dashboard's hourly and daily charts over 1M lines went from 61.8 s to 0.1 s in the design benchmark.
- Indexing memory is bounded by one block per log file, sized to the memory of the machine.
- Rotated logs are followed, not indexed again: a file renamed by logrotate, copied by copytruncate or compressed to
.gzis read on from where indexing stopped. - A crash leaves no corrupt index behind: a torn block is cut off when the store opens.
- Free-text search keeps substring matching and skips every block that cannot hold the term, using a small trigram filter stored with each block. On 1M lines, a term that only appears in one window of the log is found in 16 ms, and a search for a term that is not there returns in under 0.1 ms.
- Error logs can be indexed and searched, the search box takes field filters such as
status:5xx,ip:10.0.0.0/8,country:CNorrt:0.1..0.5, and visitors are located by country with the GeoLite2 country database built in; the city database is only needed for provinces and cities.
🔒 Certificates and security
- Redesigned certificate pages show each certificate's state, renewal method and issuer.
- njs and Perl directives can be applied after a two-factor step-up.
/api/debugno longer exposes request traces, and audit logs redact credentials, plugin settings included.
🛠️ For plugin developers
nginx-ui pluginscaffolds Go and Rust plugins, lints, runs conformance checks, packs and manages signing keys.- SDKs for Go, Rust and web pages, and the developer guide at nginxui.com/plugin.
⚠️ Upgrading from v2
- DNS-01 certificates. If a certificate uses the DNS-01 challenge, Nginx UI installs the official DNS-01 plugin on its own after the upgrade: from the package bundled in the Docker image, or from the marketplace. A node that runs neither the Docker image nor has access to the marketplace can upload the package from the plugin-dns01 releases on the Plugins page. Until the plugin is installed, those certificates cannot be renewed, and Nginx UI shows a notification.
- Plugin directory. Plugins are installed in
pluginsnext toapp.ini, for example/etc/nginx-ui/plugins. Keep it on persistent storage; in Docker it is inside the/etc/nginx-uivolume. - Log index. The new column store indexes your logs again after the upgrade. Large logs take a while the first time.
Changes since v2.9.5
Features
- A plugin system: install, update and remove plugins from the official marketplace at plugins.nginxui.com or other catalogs, upload offline packages, and keep plugins in sync across cluster nodes. Packages are signed, and each plugin shows its trust level and the permissions it asks for by @Hintay (b2610759, efa391fa, 64ada381, c74017d1)
- DNS providers move into the official DNS-01 plugin. It is installed automatically when a certificate needs it, and the Docker image bundles it so DNS-01 renewals keep working after an upgrade, offline nodes included by @Hintay, @0xJacky (efa391fa, 43205eb3)
- Plugins can add DNS-01 providers, HTTP pages, notifications, probes, MCP tools, backup storage, certificate deployment, content and log sinks, run under memory and CPU limits, and talk to the host over gRPC or, on Windows, named pipes by @Hintay (895054ae, ab22f745, ee55b623, a64e31b0, a2add0bd, bf7ddad5, c555485e)
- Plugin authors get
nginx-ui plugincommands to scaffold Go and Rust plugins, lint, run conformance checks, pack and manage signing keys, plus a developer guide at nginxui.com/plugin by @Hintay (5a6bc9de, 9e5012a1, 8b4701e4, 798e20d4) - The marketplace shows screenshots, why a plugin needs each permission, release notes, beta channels and earlier versions, partner pricing, and tells you when an installed version was withdrawn or a plugin was taken down by @Hintay (fbb30370, dc8ebe22, 125bea68, c9d77e72, 874f4ba3, ec6919da)
- Log analytics now runs on a built-in column store instead of Bleve, with far smaller indexes and faster dashboards; logs are indexed into the new store after upgrading by @0xJacky (3e9dd7d7, 6c305097, ed6e9496)
- Error logs can be indexed and searched, the log search box accepts field filters, and visitors are located by country without downloading the GeoLite2 city database by @0xJacky (8c620cb9, 71289530, 94a6c702)
- The main node can issue DNS-01 certificates for other nodes, and the redesigned certificate pages show each certificate's state, renewal method and issuer by @Hintay (d41c852c, 0be875b5, 88d35527, 32d68f93)
- Administrators can apply njs and Perl directives after a two-factor step-up instead of being blocked from editing such configurations by @0xJacky (8ba22d40)
- DNS credential forms follow each provider's form, including methods with fixed values or no input by @Hintay (f6c4d121, 559d69bb)
- Block templates from plugins appear as snippet templates by @Hintay (bc34c12e)
- The Unraid templates note that plugins are kept in the Nginx UI appdata path and that the image bundles the DNS-01 plugin by @0xJacky (9210ae88)
- Free-text search skips the log blocks that cannot contain the term by @0xJacky (cc5f2261)
Bug Fixes
- Request traces are no longer exposed under
/api/debug, and audit logs redact credentials such as passwords, keys and tokens by @0xJacky (d29d549d, e9c97f2e, d90b3904) - Audit logs redact plugin settings and the forms of plugin-backed features by @Hintay (c614e25f)
nginx.confstays editable when a distribution enables njs or Perl modules by @0xJacky (37b5f38e)- Commented
load_modulelines are ignored when detecting modules by @Dev-next-gen (55162d6e) - Log indexing and free-text scans stay within a memory budget by @0xJacky (8e4e7c8d, f4e7af14)
- Proxied index management calls require a secure session by @0xJacky (31323bd2)
- Certificate names containing path characters are refused, and certificate paths are editable on the import form by @Hintay (a3d2ba4f, 7ec6b355)
- Searching configurations no longer builds a full-text index by @Hintay (7e719760)
- Backups use one retention count for every storage by @Hintay (b34ee2b2)
🎉 Nginx UI v3 正式发布。 这是 v2 以来最大的一次更新：Nginx UI 开始支持插件。DNS 服务商、通知、备份存储、证书部署等功能都可以由插件提供，插件从经过签名的插件市场安装；日志分析则彻底重写，仍然内置在 Nginx UI 中。
❤️ 感谢所有参与 v3 测试的用户，也感谢设计并实现插件系统的 @Hintay。
✨ 主要更新
🧩 插件系统
- 在插件页面安装、更新和卸载插件，插件可以来自官方插件市场、你自己的插件目录，也可以上传离线插件包。
- 插件可以提供 DNS-01 服务商、页面、通知、探测、MCP 工具、备份存储、证书部署、内容和日志接收。
- 每个插件在独立进程中运行。插件崩溃后会自动重启，反复崩溃则会被停止，不会拖垮 Nginx UI。在 Linux 上，内存不足时系统会先停止插件，而不是 Nginx UI；启用 cgroup v2 时，插件还会受内存和 CPU 限制。
- 插件会声明所需权限并说明原因。更新如果需要新的权限，会等待你确认；插件会在集群节点之间同步。
📦 更轻量的核心
DNS 服务商移出核心之后，所有安装都变小了，服务商也可以单独更新：
| v2.9.5 | v3.0.0 | ||
|---|---|---|---|
| 二进制文件（linux/amd64） | 142.4 MB | 100.2 MB | −30% |
下载包（nginx-ui-linux-64.tar.gz）
| 45.4 MB | 33.7 MB | −26% |
| Go 模块依赖 | 361 | 205 | −43% |
- 只有签发 DNS-01 证书的节点才会安装 DNS-01 插件（linux/amd64 为 19.6 MB），其中包含 lego 支持的全部 222 个服务商。
- 新增服务商和服务商修复会以插件版本的形式从插件市场发布，无需等待 Nginx UI 发新版本。
🛒 官方插件市场和开发者中心
- 内置官方插件市场 plugins.nginxui.com。所有插件包均经过签名，每个插件都会显示信任等级：官方、认证合作伙伴或社区。
- 插件市场会展示截图、每项权限的申请原因、更新日志、测试版通道和历史版本，并在已安装版本被撤回或插件被下架时提示用户。
- 插件作者在开发者中心提交和管理自己的插件。
🌐 DNS-01 成为官方插件
- DNS 服务商移入官方 DNS-01 插件，签发 DNS-01 证书的节点会自动安装该插件。Docker 镜像已内置该插件，容器无需下载即可继续续期。
- 主节点可以为其他节点签发 DNS-01 证书。
📊 日志分析基于列式存储全面重写
Bleve 是全文搜索引擎，它为每行日志保存一个文档，并为几乎所有字段建立索引。而日志分析只会按时间、取值或子串过滤，再做计数、分组或分页，因此 v3 改用专为此设计的列式存储：列按字典编码并分别用 zstd 压缩，按块存放，查询可以按时间范围直接跳过无关的块。
在 10 万行 combined 格式日志上的测试结果（Apple M5 Pro）：
| v2（Bleve） | v3（列式存储） | ||
|---|---|---|---|
| 每行索引占用磁盘 | 1508 B（原始日志的 8.6 倍） | 28.5 B（原始日志的 0.16 倍） | 缩小 53 倍 |
| 每行索引 CPU 耗时 | 134 µs | 0.98 µs | 快 136 倍 |
| 索引过程分配内存 | 9.2 GB | 216 MB | 减少 42 倍 |
| 日志查看页 | 1479 ms | 19.9 ms | 快 74 倍 |
| 仪表盘浏览器、系统和设备图表 | 75.8 ms | 0.56 ms | 快 135 倍 |
| 仪表盘前 100 个 URL | 64.7 ms | 5.7 ms | 快 11 倍 |
| 世界地图 | 84.1 ms | 0.31 ms | 快 275 倍 |
在设计阶段的基准测试中，100 万行日志的仪表盘按小时和按天统计从 61.8 秒降到 0.1 秒。
- 索引内存以每个日志文件一个块为上限，块大小随机器内存调整。
- 日志轮转后会接着读取，不会重新索引：被 logrotate 重命名、被 copytruncate 复制或被压缩成
.gz的文件，都会从上次索引停下的位置继续。 - 崩溃不会留下损坏的索引：存储打开时会截掉写了一半的块。
- 全文搜索仍按子串匹配，并借助每个块自带的小型三元组过滤器，跳过所有不可能包含该词的块。在 100 万行日志中，只出现在某一时段的词 16 毫秒即可找到，搜索不存在的词不到 0.1 毫秒即可返回。
- 支持索引和搜索错误日志，搜索框支持
status:5xx、ip:10.0.0.0/8、country:CN、rt:0.1..0.5这样的字段过滤；内置 GeoLite2 国家数据库，可直接按国家定位访客，只有省份和城市才需要城市数据库。
🔒 证书与安全
- 重新设计的证书页面会显示每张证书的状态、续期方式和签发者。
- 完成两步验证后即可应用 njs 和 Perl 指令。
/api/debug不再暴露请求记录，审计日志会脱敏凭据，包括插件设置。
🛠️ 面向插件开发者
nginx-ui plugin命令可以创建 Go 和 Rust 插件脚手架、进行 lint 和一致性检查、打包并管理签名密钥。- 提供 Go、Rust 和网页 SDK，开发者指南见 nginxui.com/plugin。
⚠️ 从 v2 升级
- DNS-01 证书。 如果有证书使用 DNS-01 验证，升级后 Nginx UI 会自动安装官方 DNS-01 插件：优先使用 Docker 镜像内置的插件包，否则从插件市场下载。既不使用 Docker 镜像、也无法访问插件市场的节点，可以从 plugin-dns01 的 Releases 下载插件包，在插件页面上传。插件安装之前，这些证书无法续期，Nginx UI 会发出通知。
- 插件目录。 插件安装在
app.ini所在目录下的plugins中，例如/etc/nginx-ui/plugins，请确保它位于持久化存储上；在 Docker 中它位于/etc/nginx-ui卷内。 - 日志索引。 升级后新的列式存储会重新索引日志，日志量较大时首次索引需要一些时间。
中文更新日志
新功能
- 插件系统：可以从官方插件市场 plugins.nginxui.com 或其他插件目录安装、更新和卸载插件，也可以上传离线插件包，插件会在集群节点之间同步。插件包均经过签名，每个插件都会显示其信任等级和所需权限 by @Hintay (b2610759, efa391fa, 64ada381, c74017d1)
- DNS 服务商移入官方 DNS-01 插件。证书需要时会自动安装该插件；Docker 镜像已内置该插件，升级后 DNS-01 证书仍可正常续期，离线节点也不受影响 by @Hintay, @0xJacky (efa391fa, 43205eb3)
- 插件可以提供 DNS-01 服务商、HTTP 页面、通知、探测、MCP 工具、备份存储、证书部署、内容和日志接收，可在内存和 CPU 限制下运行，并通过 gRPC 或（Windows 上）命名管道与主程序通信 by @Hintay (895054ae, ab22f745, ee55b623, a64e31b0, a2add0bd, bf7ddad5, c555485e)
- 插件作者可以使用
nginx-ui plugin命令创建 Go 和 Rust 插件脚手架、进行 lint 和一致性检查、打包并管理签名密钥，nginxui.com/plugin 提供了开发者指南 by @Hintay (5a6bc9de, 9e5012a1, 8b4701e4, 798e20d4) - 插件市场会展示截图、每项权限的申请原因、更新日志、测试版通道和历史版本、合作伙伴定价，并在已安装版本被撤回或插件被下架时提示用户 by @Hintay (fbb30370, dc8ebe22, 125bea68, c9d77e72, 874f4ba3, ec6919da)
- 日志分析改用内置的列式存储取代 Bleve，索引体积大幅缩小，仪表盘更快；升级后日志会重新索引到新的存储中 by @0xJacky (3e9dd7d7, 6c305097, ed6e9496)
- 支持索引和搜索错误日志，日志搜索框支持字段过滤，无需下载 GeoLite2 城市数据库即可按国家定位访客 by @0xJacky (8c620cb9, 71289530, 94a6c702)
- 主节点可以为其他节点签发 DNS-01 证书；重新设计的证书页面会显示每张证书的状态、续期方式和签发者 by @Hintay (d41c852c, 0be875b5, 88d35527, 32d68f93)
- 管理员完成两步验证后即可应用 njs 和 Perl 指令，不会再因此无法编辑这类配置 by @0xJacky (8ba22d40)
- DNS 凭据表单按各服务商的表单渲染，支持固定值或无需输入的认证方式 by @Hintay (f6c4d121, 559d69bb)
- 插件提供的配置块模板会作为片段模板出现 by @Hintay (bc34c12e)
- Unraid 模板注明插件保存在 Nginx UI 的 appdata 路径中，且镜像已内置 DNS-01 插件 by @0xJacky (9210ae88)
- 全文搜索会跳过不可能包含搜索词的日志块 by @0xJacky (cc5f2261)
问题修复
/api/debug不再暴露请求记录，审计日志会脱敏密码、密钥和令牌等凭据 by @0xJacky (d29d549d, e9c97f2e, d90b3904)- 审计日志会脱敏插件设置以及由插件提供的功能表单 by @Hintay (c614e25f)
- 发行版启用 njs 或 Perl 模块时，
nginx.conf仍可编辑 by @0xJacky (37b5f38e) - 检测模块时会忽略被注释的
load_module行 by @Dev-next-gen (55162d6e) - 日志索引和全文扫描会控制在内存预算之内 by @0xJacky (8e4e7c8d, f4e7af14)
- 通过代理调用索引管理接口需要安全会话 by @0xJacky (31323bd2)
- 拒绝包含路径字符的证书名称，导入证书表单中的证书路径可以编辑 by @Hintay (a3d2ba4f, 7ec6b355)
- 搜索配置不再构建全文索引 by @Hintay (7e719760)
- 备份对所有存储使用同一个保留数量 by @Hintay (b34ee2b2)