10 Configure Core EN

🇬🇧 English · 🇮🇷 فارسی

Configure the node core (Xray) — for the seller

This explains exactly how you, the operator/seller, configure the node's Xray core. This config is shared by all customers; each customer's users are injected into these inbounds automatically.

Key concepts (read this)

• The node has a fixed config: /var/lib/pg-node-agent/fixed-config.json on the server.
• Keep the inbound clients array empty. The system adds/removes users per tenant; you only define the inbound "shape" (port/protocol/TLS/...).
• The inbound tag must match PG_AGENT_FORCE_INBOUNDS (default vless-in) so customer users land on it.
• Because the node is quota-based, config sent by a customer's PasarGuard panel is ignored; only your config runs.
• The customer must recreate this same inbound in their panel for their user links to work (port/protocol/SNI/Reality... must match). See the bottom of this page.

Three ways to set the config

Way 1 — web panel (simplest)

http://PANEL_IP:8080/ → Nodes → click "Details" on the node → from there you can:

• View/edit/apply the Xray config (ready-made templates included).
• Start / Restart / Stop the core (like a normal PasarGuard node).
• Switch the Xray version (enter a version or latest; the node downloads it and restarts the core).
• Update the node (pulls the latest node binary and restarts the service — like the script).
• Copy the master key / core key / certificate / addresses, or change them via "Edit node".

Way 2 — panel API

# get the current live config
curl http://PANEL_IP:8080/api/v1/nodes/<NODE_ID>/config -H "Authorization: Bearer $PANEL_TOKEN"

# apply a new config (pushed to the node, core restarts)
curl -X PUT http://PANEL_IP:8080/api/v1/nodes/<NODE_ID>/config \
  -H "Authorization: Bearer $PANEL_TOKEN" -H "Content-Type: application/json" \
  --data @config.json

Way 3 — directly on the node server

sudo pg-node-agent edit      # edit fixed-config.json
sudo pg-node-agent restart   # apply

Way 4 — from your own PasarGuard panel via the "core key" (like a normal node) ⭐

The easiest way to manage the core: add the node to a PasarGuard panel you own and edit the core config from its GUI — exactly like a normal PasarGuard node.

• The node accepts core config only from the core key; customer keys can't change it (safe).
• The core key is generated by default at install and printed (look for "Core key"). If you installed an older version, re-run install once or pass --core-key.

In your PasarGuard panel, add the node with:

Field	Value
Address / Port	NODE_IP + gRPC port (default 62050)
Protocol	gRPC
Certificate	the node certificate
API Key	the core key (not master, not a customer key)

Then edit that node's Xray/Core in the panel and save; the config applies to the shared core and active customers' users are reapplied. User/Stop ops on this connection are ignored so multi-tenancy doesn't break.

core key vs master key: master is for the main selling panel (NodePanel) and manages the whole node/customers; the core key is only for managing the core config from a PasarGuard panel. Both work at the same time.

Production example: VLESS + Reality (no domain/cert)

Reality suits restrictive networks and needs no domain or certificate. Steps:

1) Generate a Reality key on the node server:

/var/lib/pg-node-agent/xray-core/xray x25519
# Private key: <PRIVATE_KEY>
# Public key:  <PUBLIC_KEY>

The private key goes into the node config; the public key is given to the customer (or the system derives it automatically and shows it in "Customer connection").

2) Make a shortId: e.g. openssl rand -hex 8 → 0123456789abcdef.

3) Config:

{
  "log": { "loglevel": "warning" },
  "inbounds": [
    {
      "tag": "vless-in",
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",
      "settings": { "clients": [], "decryption": "none" },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "dest": "www.microsoft.com:443",
          "xver": 0,
          "serverNames": ["www.microsoft.com"],
          "privateKey": "<PRIVATE_KEY>",
          "shortIds": ["", "0123456789abcdef"]
        }
      },
      "sniffing": { "enabled": true, "destOverride": ["http", "tls", "quic"] }
    }
  ],
  "outbounds": [ { "tag": "direct", "protocol": "freedom" } ]
}

VLESS+Reality users usually use flow: xtls-rprx-vision; the customer's panel sets this per user and the system applies it.

Alternative: VLESS + WebSocket + TLS (domain/CDN)

{
  "log": { "loglevel": "warning" },
  "inbounds": [
    {
      "tag": "vless-in",
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",
      "settings": { "clients": [], "decryption": "none" },
      "streamSettings": {
        "network": "ws",
        "security": "tls",
        "wsSettings": { "path": "/vless" },
        "tlsSettings": {
          "serverName": "your.domain.com",
          "certificates": [
            { "certificateFile": "/etc/ssl/your.crt", "keyFile": "/etc/ssl/your.key" }
          ]
        }
      },
      "sniffing": { "enabled": true, "destOverride": ["http", "tls", "quic"] }
    }
  ],
  "outbounds": [ { "tag": "direct", "protocol": "freedom" } ]
}

After setup: what to give the customer

In the panel, click "Customer connection" on the subscription (or GET /api/v1/subscriptions/{id}/connection). You get:

• gRPC address: NODE_IP:62050
• Protocol: gRPC
• Node certificate (to pin)
• Node inbounds: the same JSON above — but secured: the Reality private key is removed and the public key added so the customer can build links.

The customer recreates an inbound in their PasarGuard panel with the same values:

Field	Must equal
Port	443 (or yours)
Protocol / Network	vless / tcp (or ws)
Security	reality (or tls)
SNI / serverNames	www.microsoft.com (or your domain)
Reality publicKey (pbk)	the node's public key
shortId (sid)	one of your shortIds
flow	xtls-rprx-vision (for Reality)

If these don't match, the end-user link won't connect.

Multiple inbounds

You can define several inbounds (e.g. Reality on 443 and WS on 8443). List all tags you want customer users on, comma-separated, in PG_AGENT_FORCE_INBOUNDS:

sudo pg-node-agent edit-env
# PG_AGENT_FORCE_INBOUNDS=vless-in,vless-ws
sudo pg-node-agent restart

Health check

sudo pg-node-agent status
sudo pg-node-agent logs        # Xray config errors show here

Or from the panel: GET /api/v1/nodes/{id}/health → should show core_started: true.