Document successful 20.04 install test, patches, and quirks

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -126,6 +126,36 @@ Gitea creds live in `.gitea/` (git-ignored): `token` and `url`. The token is
 scoped **public-only + write:repository + write:package**. Rotate it in Gitea
 (Settings → Applications) if it's ever exposed.
 
+## Tested
+
+End-to-end on a clean **Ubuntu 20.04.6** box (2026-06): one-liner → unattended
+install → `xuione` active, **MariaDB 10.6.22**, nginx on :80, `xui` DB imported,
+panel setup page (`/<code>/setup`) returns HTTP 200.
+
+### Installer patches (applied automatically by `patch_installer`)
+
+The 2025-era bundled `install` references two now-broken sources; the wrapper
+rewrites them on the fly:
+
+| Problem | Fix |
+|---|---|
+| MariaDB 10.6 repo `ams2.mirrors.digitalocean.com` no longer resolves (DO retired their distro mirrors) | Rewritten to `mirror.rackspace.com/mariadb/repo/10.6/ubuntu` |
+| `add-apt-repository ppa:maxmind/ppa` hangs forever where `launchpad.net` is unreachable | Dropped — `libmaxminddb0/-dev`, `mmdb-bin` come from Ubuntu's own repos |
+
+### Harmless warnings you can ignore
+
+- `E: Unable to locate package libssh2-1t64` — that's the Ubuntu 24.04 (noble)
+  package name; on 20.04/22.04 the needed `libssh2-1` is pulled in by `php-ssh2`
+  automatically. `ssh2` ends up loaded in XUI's PHP regardless.
+- `debconf: ... dumb terminal` / locale warnings — expected under non-interactive apt.
+
+### Security note
+
+XUI's bundled `my.cnf` sets `bind-address = *`, so MariaDB listens on
+`0.0.0.0:3306`. The `xui` DB user has a strong random password and root uses
+socket auth, but consider firewalling 3306 to localhost if the box is on a
+public IP.
+
 ## System requirements
 
 - Ubuntu 20.04 / 22.04 / 24.04 LTS, clean install, x86_64