v0.0.5

Nexora Panel v0.0.5

Before you update

Panel and nodes can be updated in either order, and this panel works with nodes on v0.0.3 and v0.0.4. Node v0.0.5 is out at the same time. Update your nodes too if you use OpenVPN with MikroTik (RouterOS) clients or a Tailscale endpoint, or if you see stale "skipped" warnings on a node.

What's new

Resellers limited to chosen templates

• A reseller can now be limited to chosen templates. Its users are put only on those templates, so they reach only those templates' nodes. Turn on Only chosen templates on the admin, then pick the Allowed templates.
• Removing a template from the list takes the reseller's users off it, and off its nodes, as soon as you save. No node restarts.
• All templates on such a reseller's users means all of the reseller's templates. A template you allow later reaches those users too.
• When you create or edit a user for a limited reseller, or hand users over to one, the panel narrows the user's templates to that reseller's list instead of refusing the change.

OpenVPN and OpenConnect endpoints

• The endpoint forms now cover the settings that used to need raw JSON:
  • Push to clients: routes, DNS servers (including OpenVPN 2.6 DNS options) and ping timers sent to every client.
  • Control channel protection with tls_auth, tls_crypt or tls_crypt_v2. A probe without the key gets no answer. With tls_crypt or tls_crypt_v2, the TLS handshake and the server's certificate cannot be read on the wire.
  • A list of servers for an OpenVPN client, tried in order or picked at random.
  • A one-time-password secret and login-form answers for OpenConnect clients.
• Users' OpenVPN profiles carry the control-channel key. With tls_crypt_v2, each user gets a client key of their own, and the server key never leaves the node.
• Keys that do not fit their type are refused when the endpoint is saved, instead of reaching the node.
• Allow duplicate CN now explains what it costs. With it on, a user with an address limit can be locked out for a few minutes after reconnecting.
• The Tailscale endpoint no longer asks for a state directory: the node keeps it for you (see node v0.0.5).

Outbounds

• Outbounds get a From a preset button with a Cloudflare WARP preset. It fills a MASQUE outbound with no profile. On first start, each node registers its own WARP device and keeps it, so there is nothing to type and no account is shared between nodes. Route traffic through it with a template's routing rules.

Nodes

• A node's warnings no longer list items the panel has since removed or no longer sends to that node.
• Changing a node's port and then installing or reinstalling it moves the node to the new port. Before, the command still carried the old port.
• The install button saves the node first, so the command and the automatic install always use what the form shows.
• The SSH install shows the address the node listens on now, beside the Listen field. Leave the field empty to keep that host on the node's port.

Under the hood

• Built with Go 1.27.2. Security fixes from golang.org/x/net and the other golang.org/x modules.
• The Docker image now runs on Alpine 3.24, since Alpine 3.20 is out of support.

@MHSanaei @alireza0