v0.1.0

NX Panel v0.1.0

Nexora is now NX: this update is a move

The update button cannot install this release. It fails on purpose and
changes nothing on your server. Run the new install script once, as root, on
the panel's server:

bash <(curl -fsSL https://raw.githubusercontent.com/nx-panel/panel/main/install.sh)

It moves the install made under the old name, keeping your admins, users,
nodes, templates and settings, then installs v0.1.0. If a step fails, the old
install is put back and keeps running. The guide:
https://docs.nx-panel.org/start/move-to-nx

Before you update

• Take a backup and keep it. A backup restores only into the version that took it, and the old backup archives cannot be restored into this one.
• Do not go back to an older version over this one. The panel's addresses are kept in a new form (below), and an older version started on this database comes up on port 2095 in plain HTTP, with no domain or path.
• Update the panel first, then the nodes. This panel works with the nodes you have now; update them to v0.1.0 afterwards.

The move

• Names. The panel lives in /opt/nx-panel and /var/opt/nx-panel, runs as nx-panel, and its SQLite file is nx.db. A PostgreSQL database the old script set up on this server is renamed to nx. One of your own keeps its name and its DSN.
• A node on the same server installed with the node script moves with the panel and keeps running. One in Docker keeps running and is moved from the Nodes page.
• Everyone is logged out once: the session cookie has a new name.
• Environment variables are NX_*, and the old ones are no longer read. This matters for a panel in Docker: see the guide.
• Nodes show Needs migration. Update each one from the Nodes page, or run its install command on the node. Until then the panel still reaches it.
• Addons show Needs migration. Update each one on its host from the Addons page. That installs NX Shop v0.1.0 or NX Notif v0.4.0 and registers it again, with its answers and data kept.
• OpenVPN profiles use new keys: users download their profile or their subscription again. Tunnels reconnect by themselves.
• The licence carries over. Heartbeats go to license.nx-panel.org.

What's new

Addresses: every port, host and path the panel answers on

• Settings → Addresses replaces the address settings of the General page. The panel can listen on several ports, each with its own TLS, and decide per host and path what it serves: the panel, subscriptions, the API, a static site, a redirect, a fixed answer, or another program behind it (TLS passed through or proxied).
• Hosts can be bound to an account, which moves a reseller's subscription domain here, and each address can carry its own branding.
• A change applies at once, without a restart, and is put back by itself unless it is confirmed within two minutes. A request can be tested before saving. The address the panel was installed on always stays.

A node's own configuration is gone: give it a template of its own

• A node no longer carries outbounds, endpoints or routing of its own. A server that needs something different gets a copy of its template.
• An upgraded panel makes those copies by itself, named template · node, with the node's own outbounds and endpoints moved into the pools and its rules after the template's. Each node serves what it served before. The panel's log names the two exceptions, both on a node that had no template.

Limit an account to some of its configs

• Limit configs on a user serves the account only on the inbounds and endpoints that match its rules: by protocol, tag, TLS or transport. Show result lists what it allows, and a change applies without restarting a node.

On the Nodes page

• Test outbounds measures how long each outbound the node runs takes to fetch a test URL.
• Usage graph opens the node's traffic over time from its row.

Smaller things

• Ordered lists, such as routing rules and an account's config rules, are reordered by dragging, or from the keyboard.
• Dial options turn a detour on with a switch, so an outbound no longer carries an empty one.
• A routing rule's inbound is picked from the template's own inbounds.
• The forms explain their fields in hints beside the label.
• A WireGuard server says that it belongs on a template with a single node.

v0.0.6

Nexora Panel v0.0.6

Before you update

Update the panel before your nodes. Node v0.0.6 is out at the same time and refuses a configuration that carries a route rule with the direct action (see below). This panel removes those rules, so update it first and then the nodes. This panel works with nodes on v0.0.3 to v0.0.6.

What's new

Route rules with the direct action are removed

• The direct action never did anything. A rule using it matched, and routing then went on to the next rule as if the rule were not there.
• Node v0.0.6 refuses a whole configuration that names it. So the panel no longer offers the action, refuses to save a rule that uses it, and removes the ones already stored, from template routing and from a node's own routing, on its first start after the update. Routing does not change, because those rules never routed anything.
• To send traffic out directly, use the action route with the direct outbound.

Under the hood

• Built with Go 1.27.3, which fixes a security issue in certificate verification (GO-2026-6809).
• Interface libraries updated: PrimeVue 5.0.4, Vue 3.5.44, vue-i18n 11.4.16, vue-router 5.4.0, Chart.js 4.6.1, Vite 8.3.5.
• Addon kit v0.4.5.

@MHSanaei @alireza0

v0.0.5

Nexora Panel v0.0.5

Before you update

Panel and nodes can be updated in either order, and this panel works with nodes on v0.0.3 and v0.0.4. Node v0.0.5 is out at the same time. Update your nodes too if you use OpenVPN with MikroTik (RouterOS) clients or a Tailscale endpoint, or if you see stale "skipped" warnings on a node.

What's new

Resellers limited to chosen templates

• A reseller can now be limited to chosen templates. Its users are put only on those templates, so they reach only those templates' nodes. Turn on Only chosen templates on the admin, then pick the Allowed templates.
• Removing a template from the list takes the reseller's users off it, and off its nodes, as soon as you save. No node restarts.
• All templates on such a reseller's users means all of the reseller's templates. A template you allow later reaches those users too.
• When you create or edit a user for a limited reseller, or hand users over to one, the panel narrows the user's templates to that reseller's list instead of refusing the change.

OpenVPN and OpenConnect endpoints

• The endpoint forms now cover the settings that used to need raw JSON:
  • Push to clients: routes, DNS servers (including OpenVPN 2.6 DNS options) and ping timers sent to every client.
  • Control channel protection with tls_auth, tls_crypt or tls_crypt_v2. A probe without the key gets no answer. With tls_crypt or tls_crypt_v2, the TLS handshake and the server's certificate cannot be read on the wire.
  • A list of servers for an OpenVPN client, tried in order or picked at random.
  • A one-time-password secret and login-form answers for OpenConnect clients.
• Users' OpenVPN profiles carry the control-channel key. With tls_crypt_v2, each user gets a client key of their own, and the server key never leaves the node.
• Keys that do not fit their type are refused when the endpoint is saved, instead of reaching the node.
• Allow duplicate CN now explains what it costs. With it on, a user with an address limit can be locked out for a few minutes after reconnecting.
• The Tailscale endpoint no longer asks for a state directory: the node keeps it for you (see node v0.0.5).

Outbounds

• Outbounds get a From a preset button with a Cloudflare WARP preset. It fills a MASQUE outbound with no profile. On first start, each node registers its own WARP device and keeps it, so there is nothing to type and no account is shared between nodes. Route traffic through it with a template's routing rules.

Nodes

• A node's warnings no longer list items the panel has since removed or no longer sends to that node.
• Changing a node's port and then installing or reinstalling it moves the node to the new port. Before, the command still carried the old port.
• The install button saves the node first, so the command and the automatic install always use what the form shows.
• The SSH install shows the address the node listens on now, beside the Listen field. Leave the field empty to keep that host on the node's port.

Under the hood

• Built with Go 1.27.2. Security fixes from golang.org/x/net and the other golang.org/x modules.
• The Docker image now runs on Alpine 3.24, since Alpine 3.20 is out of support.

@MHSanaei @alireza0

v0.0.4

Nexora Panel v0.0.4

Before you update

Panel and nodes can be updated in either order. This release changes nothing the panel sends to nodes, and it works with nodes on v0.0.3 and v0.0.4. Node v0.0.4 is out at the same time with an important crash fix, so update your nodes too.

If a subscription domain in your settings includes a port (sub.example.com:2095), the port is removed on upgrade. Subscription links now take the port the panel listens on, so links that used to break keep working.

What's new

Users and owners

• Every admin and operator sees every user. An operator owns the users it creates, and the users page opens on My users only, which you can switch off.
• A main admin can hand users to another operator or reseller, one at a time or for a whole selection at once.
• Deleting an operator, or making it a main admin, gives its users back to the panel.

Nodes

• A single missed heartbeat no longer marks a node disconnected. The panel waits for two in a row, so a brief network hiccup no longer sends a disconnected/connected alert pair for a node that never stopped serving.
• The node install command works with the panel's self-signed certificate: it pins the panel's key instead of failing the download.
• Saving a node without a name, with an address that includes a scheme or port, or with a port outside 1–65535 is refused, instead of storing a node the panel cannot reach.
• The dashboard's live node traffic shows a steady rate instead of spikes and zeros.

Subscriptions

• Subscription links on a subscription domain no longer break when the domain was entered with a port.
• On a Persian subscription page, dates are shown in the Solar Hijri calendar and numbers in Persian digits. Installed themes get this without changes.

Panel interface

• Date fields use your language's calendar, including Solar Hijri for Persian.
• After you change the panel's address, port, base path or HTTPS settings, the restart sends your browser to the new address instead of the old one.
• The help button on each page opens that page in the documentation at docs.nexora-panel.org.
• Rule sets get a Presets button beside Add, as inbounds have.
• The domain fronting page layout is fixed.
• The admins list shows last login as "how long ago", with the date on hover.

Under the hood

• Built with Go 1.27.2.
• Addon contract: addon-kit v0.4.4, unchanged.

@MHSanaei @alireza0

v0.0.3

Nexora Panel v0.0.3

Before you update

Update the panel first, then your nodes. Nodes on v0.0.3 expect this panel release; this panel keeps working with older nodes, but live config changes and cleaner quota cut-offs need nodes on v0.0.3.

What's new

Changes reach your nodes without restarts

• Editing a template, routing, DNS or rule sets is applied to a running node without restarting it. The node restarts only when it has to.
• Rule sets are downloaded by the panel and sent to your nodes. Nodes no longer fetch them themselves, so one unreachable list can no longer stop a node from starting.
• Items a node cannot run are listed as warnings on the node instead of failing the whole configuration. They stay listed until a sync applies them.
• Accounts that lack the credential an inbound needs are left out of that inbound with a warning, and accounts created before credentials were generated are given them once.
• A node you switch off stops serving. Deleting a node stops it too, and the panel warns you if it could not be reached.
• Actions that need a switched-off node now answer "node is off" instead of a generic gateway error.
• A quota run now syncs each node once, however many accounts lapse in the same minute.

Addons

• Addons can be installed on the panel's own server, without SSH.
• The panel can issue an addon's HTTPS certificate and the addon fetches it. The panel's own certificate never leaves its server.
• Password fields in addon install forms are checked before the install starts (at least 10 characters).
• The addon install wizard keeps its answers and checks your input before running anything.

Subscriptions

• Subscription files now load and connect on current Xray and sing-box clients:
  • Xray: the removed HTTP/2 transport is left out, mKCP uses the legacy mask, and Hysteria2 and WireGuard are included.
  • sing-box: naive trusts the pinned certificate.
• Options that only matter to client apps, and ECH options that sing-box removed, are no longer offered or saved.
• VLESS Encryption can be used on outbounds.

Panel interface

• A new dashboard card walks a fresh install through its first inbound, template, node and user. Empty pages point to the next step, and nodes without a template are flagged.
• Server addresses and certificate names are blurred until you hover them.
• The sidebar groups fold away when the sidebar stops peeking, and the licence and update banners are softer in the dark theme.
• You are told when a node is behind the newest node release.

Under the hood

• Built with Go 1.27.2, which includes the latest standard-library security fixes.
• Addon contract: addon-kit v0.4.4.

@MHSanaei @alireza0

v0.0.2

Second release of Nexora Panel. Pairs with node v0.0.2.

Update your nodes to v0.0.2 as well. Rule sets now reach nodes only by push, so a node older than v0.0.2 runs without its rule sets, and the route test needs v0.0.2 too.

bash <(curl -fsSL https://raw.githubusercontent.com/nexora-vpn/panel/main/install.sh)

Upgrading from v0.0.1: use the update notice in the panel. It takes a backup, swaps the binary and rolls back on its own if the new build does not come up. Running the installer again also works.

Docs: English · فارسی · Русский · 中文

What's new

Services menu

• Telegram: notices for admins in a private chat or a group. Every account can pair its own chat, and the read-only commands /status, /user and /node answer within that account's reach.
• Email: notices over SMTP. Each address is confirmed by a code mailed to it.
• Delivery log for every Telegram chat and email address, with send again.
• Backup destinations: each backup is copied to S3-compatible storage, SFTP or a Telegram chat. Each destination can keep its own number of backups.
• Single sign-on: Google, Microsoft, GitHub, GitLab, Keycloak, Authentik, Okta, Auth0, or any OpenID Connect or OAuth 2.0 provider. Each account links its own identity.
• Webhooks now live under Services.

Addons

• Addons are separate programs that the panel registers. It never runs them.
• Browse the addon directory at addons.nexora-panel.org from inside the panel.
• Install an addon with a ready-made command and a claim code, or let the panel install, update and remove it on a host over SSH. Every file it uploads is checked against the release's signed checksums.
• Manage a registered addon: suspend or resume it, watch its health, and approve an update only when the newer version asks for more permissions.

Nodes and routing

• Route test page: ask a node which rule and outbound a connection would take, check what a rule set matches, and optionally make one real connection through it.
• Rule sets are pushed to nodes over the control link and kept there as local files. Nodes no longer download rule sets, so the download address and its setting are gone. This fixes relay nodes whose default route goes through a tunnel, and a wrong panel address can no longer take every node's rule sets down. Needs node v0.0.2.

Users and resellers

• An account that an admin switches off stays off. The quota enforcer no longer turns it back on within a minute.
• An expired reseller can no longer use the panel: login, existing sessions, API tokens and Telegram commands are all refused until it is renewed.
• New API routes: read one user, change some of a user's fields with a version check (PATCH /api/users/{id}), and renew a user counted from now or from its expiry, whichever is later (POST /api/users/renew/{id}).
• New public_address setting: the address used in links when no subscription domain is set.
• Repeating a request with the same Idempotency-Key while the first one is still running now gets 409 instead of running twice.

Interface

• A menu that can be pinned or set to hide itself.
• A second built-in subscription page theme (amber).
• Collapsible scope groups when editing roles, tokens and webhooks.

Security

• The panel can no longer be embedded in a page on another site, which protects against clickjacking.

Fixes

• PostgreSQL: JSON values containing quotes, newlines or backslashes are now stored correctly. Before, they were refused or corrupted, for example failed-backup notices and regular expressions in rules.
• A restore never hands out an id that was already used (events, deliveries, accounts).
• The node health bar and the folding of its history now show the right state.
• Many smaller fixes from two full QA passes.

Breaking changes

• The rule-set download mirror (/rulesets/{token}/{tag}) and the ruleset_base_url setting have been removed. Nodes get rule sets by push only, so a node before v0.0.2 runs without them, and every rule that names one is left out.
• The old plaintext /module/* API has been removed, and its tokens are deleted on upgrade. Use API tokens (/api/v1).
• The /api/users/{id}/ext/{addon} and /api/admins/{id}/ext/{addon} routes have been removed, and their tables are dropped on upgrade. Store contact details in the user's contact field.

Reports

v0.0.1

First stable release of Nexora Panel. Pairs with node v0.0.1. @MHSanaei

bash <(curl -fsSL https://raw.githubusercontent.com/nexora-vpn/panel/main/install.sh)

Upgrading from a beta: run the installer again, after taking a backup. From this release on, the panel updates itself.

Docs: English · فارسی · Русский · 中文

Reports

v0.0.0-beta.4

New features

• Plans: a named bundle of the limits a new account starts with
• Reseller restrictions: sell from allowed plans only, or create-only
• On-hold users: the plan starts at the first connection
• Rule sets: remote sing-box rule-sets mirrored by the panel, with presets
• Bulk user operations: create in bulk, extend and gift, set limits, enable/disable, reset traffic, delete expired, export
• Batch actions and duplicate action on the list pages
• Renaming a tag rewrites every reference to it
• Summary strip and inline filters on the tunnels page @MHSanaei
• Database tuning and batched accounting writes

Bug fixes

• Move configs to sing-box 1.14, migrating legacy DNS shapes on upgrade
• Add Snell to the sing-box subscription
• UI component, alignment and RTL locale fixes
• Frontend build now requires Node.js 26

v0.0.0-beta.3

New features

• Multi solution load balancing tunnel between nodes
• Server-side user filters, sort and summary strips on every list page @MHSanaei
• Move hint texts to hover infohint

v0.0.0-beta.2

New features

• Backup & Restore
• PortMux feature speedy and high throughput internal manager ( without any action on OS's iptables ) for:
  • Hysteris/Hysteris2 internal multiport
  • IP-Limit fully control internally (also sync between all the nodes)
  • Speedlimit for each user (per node)
• Ingress inbound:
  • Multi-inbound proxy, with/without tls termination
  • Support all you need from HAproxy or nginx
  • Simulate xray's fallback
  • Active probing shields by reject/answer/proxy to another website
• Support endpoints configs on clash/singbox sub and sub theme
• UI performance: lazy load language packs

Bug fixes

• fix ovpn mtls default option when it is not enabled
• fix ipv6 listen view on front
• fix go/crypto Vulnerabilities