v1.6.17

What's Changed

feat(nodes): automatic Reality dest/SNI replacement for standalone Xray nodes

REALITY targets die over time: the site behind them goes offline, drops TLS 1.3/H2, or its certificate expires or stops covering the SNI. When that happens the location stops working for every client. The panel now detects this and replaces the dest automatically.

• Health checks every 15 minutes: the panel connects to every Reality dest with each configured SNI and requires DNS resolution, TLS 1.3, ALPN h2, X25519 and a valid certificate issued for that SNI. Identical dests shared by several nodes are checked once per run.
• Automatic replacement: after 3 consecutive failures the panel scans the node's /24, picks the fastest host that passes the same checks and is not used by any other node or cascade link, writes it to dest/SNI and applies the config. All Reality inbounds of the node that shared the dead dest receive the same replacement.
• Safe rollout:
  • The config is validated with xray run -test before restart. If the push fails, the previous dest/SNI is restored in the database.
  • A config that is already running on the node is kept, even when agent health could not be confirmed.
  • Mass failures (≥50% of dests, at least 3) are treated as a panel network issue, and the run is discarded.
  • A node is replaced automatically at most once every 6 hours. A scan that found nothing is retried after an hour, and only one /24 scan runs at a time.
  • Nodes without SSH, offline nodes and nodes busy with another operation are not touched.
• Per-node mode: Automatic (default), Notify only or Off, configured in the new REALITY target auto-replacement block on the node's Inbounds tab. The block shows the current status, last check time, failure reason and the last replacement. It is visible whenever any inbound uses Reality.
• Node list badge for nodes whose dest is down or has no replacement.
• New webhooks: node.reality_dest_dead (notify mode, no candidate, cooldown or rollback) and node.reality_dest_rotated (oldDest, newDest, newSni, reason).
• Scope: standalone Xray nodes only. Cascade nodes and links, CDN nodes, and local/self-steal dests (unix sockets, bare ports, loopback/private addresses) are skipped.

Clients receive the new SNI on their next subscription update, so a shorter subscription update interval means faster recovery.

If your webhook settings use an explicit event list, enable the two new events to receive them.

CC Agent binaries

Lightweight Go agent for managing Xray on nodes.
Downloaded automatically during node auto-setup from the panel.

File	Architecture
cc-agent-linux-amd64	x86_64 (most VPS)
cc-agent-linux-arm64	ARM64

Celerity Probe binaries

External diagnostic probe. Installed by the operator on their own
host; holds only client subscription credentials and no node access.
The install command with a single-use token is generated in the panel.

File	Platform
celerity-probe-linux-amd64	Linux x86_64
celerity-probe-linux-arm64	Linux ARM64
celerity-probe-linux-mipsle	OpenWRT MIPS little-endian (ramips, mt7621)
celerity-probe-linux-mips	OpenWRT MIPS big-endian (ath79)
celerity-probe-darwin-amd64	macOS Intel
celerity-probe-darwin-arm64	macOS Apple Silicon
celerity-probe-windows-amd64.exe	Windows x86_64
celerity-probe-windows-arm64.exe	Windows ARM64

Panel source code is distributed via Docker Hub: clickdevtech/hysteria-panel

Full Changelog: v1.6.16...v1.6.17