v1.6.18

What's Changed

feat(nodes): Reality Guard confirms failures from the node and uses a reserve SNI list

Reality Guard (added in v1.6.17) no longer acts on the panel's view alone. The node is what actually connects to the dest, so the final verdict now comes from the node.

• Confirmation from the node: after 3 consecutive failed checks, the panel opens one SSH session to the node and repeats the check there with openssl s_client (TLS 1.3, X25519, certificate verified for the SNI).
  • If the node reaches the dest, nothing is replaced and no alert is sent. The panel-side failure is shown as a note, and the node is not asked again for 6 hours.
  • If the node confirms the failure, the dest is replaced (Automatic) or reported (Notify only). Notify mode no longer sends alerts that the node would refute.
  • Nodes without openssl/timeout, or with an OpenSSL build that lacks TLS 1.3 options, fall back to the panel verdict. The reason then includes node_check_unavailable.
• Reserve SNI list: a new per-node Reserve SNIs field (up to 20 domains). On replacement, the panel tries the list in order first and falls back to the /24 scan only if no entry works. Every candidate is verified from the node in the same SSH session and must not be used by any other node. The panel never edits the list: an entry that fails is skipped for 24 hours, and its status is shown next to the list.
• HTTP/2 is now a warning: Xray works without H2, so a dest without ALPN h2 is kept. An h2 badge in the node list and a warning in the node form suggest picking a site with H2 support.
• Portal nodes are guarded in addition to standalone nodes. Bridge and relay nodes are still skipped, and the tunnel Reality of cascade links is never touched.
• Readable reasons: failure reasons are shown in plain language in the node form.
• Webhook: node.reality_dest_dead with cause: no_candidate now includes candidates, the checked reserve/scan domains with the reason each one was rejected.
• Retries: a node that was already reported is retried at most once per hour, in Automatic mode only and not during the 6-hour cooldown.

Behaviour change: existing Portal nodes default to Automatic, so the panel may now replace their dest on its own. Switch the mode to Notify only or Off on the node's Inbounds tab if you manage these dests manually.

feat(settings): option to disable the domain decoy

Settings → Security → Domain Decoy has a new mode, No decoy (redirect to /panel): the domain root redirects to /panel instead of serving the nginx or custom page. The panel asks for confirmation, since this reveals the panel path to any visitor. The uploaded custom HTML is kept, and Restore built-in page no longer turns the decoy back on while it is disabled. The default is still the nginx page.

UI

• Node form save bar: Cancel and Save are grouped on the right and stretch to full width on narrow screens.

CC Agent binaries

Lightweight Go agent for managing Xray on nodes.
Downloaded automatically during node auto-setup from the panel.

File	Architecture
cc-agent-linux-amd64	x86_64 (most VPS)
cc-agent-linux-arm64	ARM64

Celerity Probe binaries

External diagnostic probe. Installed by the operator on their own
host; holds only client subscription credentials and no node access.
The install command with a single-use token is generated in the panel.

File	Platform
celerity-probe-linux-amd64	Linux x86_64
celerity-probe-linux-arm64	Linux ARM64
celerity-probe-linux-mipsle	OpenWRT MIPS little-endian (ramips, mt7621)
celerity-probe-linux-mips	OpenWRT MIPS big-endian (ath79)
celerity-probe-darwin-amd64	macOS Intel
celerity-probe-darwin-arm64	macOS Apple Silicon
celerity-probe-windows-amd64.exe	Windows x86_64
celerity-probe-windows-arm64.exe	Windows ARM64

Panel source code is distributed via Docker Hub: clickdevtech/hysteria-panel

Full Changelog: v1.6.17...v1.6.18