A multi-node VPN control plane built on sing-box.
One panel, any number of nodes, 20+ protocols, and subscriptions your clients already understand.
Nexora is a two-part system for running a fleet of VPN servers from a single place.
| Component | Role |
|---|---|
| Nexora Panel | The control plane: a Go service with an embedded Vue 3 admin UI. It is the single source of truth (SQLite or PostgreSQL) for users, protocols, templates and nodes, hands subscription links to end-users, and drives every node. |
| Nexora Node | The data plane: a stateless agent running an extended sing-box engine. It has no database — the Panel pushes all configuration to it over HTTPS with mutual TLS. |
Fleet management
- Nodes are stateless. Register one in the Panel, then bring it up with a single command copied from there: it installs the agent, fetches the Panel's client certificate with a one-time install token, generates its own server certificate and comes up under mTLS with trust-on-first-use pinning.
- Global pools of inbounds, outbounds and endpoints, composed into templates (pool items + routing + core settings) that are assigned to nodes.
- Live, incremental updates: adding a user or an inbound reaches running nodes without a restart, and every operation falls back to a full resync if anything goes wrong.
- Heartbeats, per-node traffic accounting, per-node traffic caps (weekly, monthly or yearly) that take a node offline until the next period starts, live log streaming, host metrics and a pinnable tile dashboard.
Users & subscriptions
- Volume quotas, expiry dates, scheduled resets and automatic enforcement.
- One subscription URL per user, rendered on the fly as v2ray share links, Clash / mihomo YAML, sing-box JSON, Xray JSON or plain text. Clash / mihomo and sing-box clients are detected from their User-Agent; everyone else gets the operator-chosen default format unless one is named in the URL, and the Clash, sing-box and Xray base templates are editable.
- Ready-to-import profiles for WireGuard (
.conf) and OpenVPN (.ovpn), plus connection details (server URL and credentials) for OpenConnect / AnyConnect clients.
Operations
- Three roles:
sudo(owner),admin(operators) and resellers, who see only the users they own and work within their own volume and expiry allowance. - Bearer API tokens for integrations, a webhook for module events, an opt-in audit log of admin changes (who created, updated or deleted what), and an OpenAPI 3 specification served by the Panel itself.
- Certificates: self-signed (generated by the Panel and pinned in subscriptions) or ACME obtained by the node itself (HTTP-01, TLS-ALPN-01, or DNS-01 via Cloudflare, AliDNS or ACME-DNS), both renewed automatically — or bring your own. REALITY and ECH key generation built in.
- Admin UI in English, Persian (RTL), Chinese and Russian, with light, dark and high-contrast themes.
Everything the node engine supports is configurable from the Panel.
| Inbounds (user-carrying) | VLESS · VMess · Trojan · Shadowsocks · SOCKS · HTTP · Mixed · NaïveProxy · Hysteria · Hysteria2 · TUIC · ShadowTLS · AnyTLS · Mieru · SSH · Snell · MTProxy · TrustTunnel |
| Inbounds (shared key) | Sudoku — one key per inbound, no per-user accounting |
| Inbounds (transparent) | TUN · Redirect · TProxy · Direct |
| Outbounds | Direct · Block · SOCKS · HTTP · Shadowsocks · VMess · VLESS · Trojan · Hysteria · Hysteria2 · TUIC · ShadowTLS · AnyTLS · SSH · NaïveProxy · Mieru · Snell · Sudoku · TrustTunnel · MASQUE · Tor · Selector · URLTest |
| Endpoints | WireGuard (multi-user) · Tailscale · OpenVPN server / client · OpenConnect server / client |
| Transports | TCP · WebSocket · gRPC · HTTP · HTTPUpgrade · QUIC · XHTTP · mKCP |
| Security | TLS · REALITY · ECH · uTLS · Your own certificates · node-managed certificates · self-signed |
Per-user traffic accounting covers every user-carrying inbound and the WireGuard, OpenVPN and OpenConnect server endpoints.
| Panel | Node | |
|---|---|---|
| Binary | nexora-panel — Linux (amd64, arm64, armv5/v6/v7, 386, s390x, riscv64) and Windows (amd64, arm64) |
nexora-node — Linux (amd64, arm64, armv5/v6/v7, 386, s390x, riscv64) |
| Docker | ghcr.io/nexora-vpn/nexora-panel (amd64, arm64) |
ghcr.io/nexora-vpn/nexora-node (amd64, arm64) |
| Service | systemd unit included · web UI and API on port 2095 |
systemd unit included · control API on port 62050, mTLS only — the Node accepts the Panel's client certificate and nothing else; firewall the port to the Panel's address |
| State | SQLite file by default, PostgreSQL optional | No database — only its certificates and a small cache on disk |
Both are single self-contained binaries. The Node's NaïveProxy outbound links Chromium's cronet, which the release builds bundle for amd64, arm64, armv7 and 386. Container images are published with each tagged release.
- Nexora Panel and Nexora Node are proprietary software, licensed per installation. Without a key the Panel runs on a free tier — 1 inbound, 1 outbound, 1 endpoint, 1 user, 1 node — with the full feature set, so you can evaluate everything before buying. The Node needs no key of its own; the Panel's license caps how many nodes it will drive.
- A license is a signed token bound to the Panel host's hardware fingerprint (HWID) that raises the per-resource limits.
nexora-panel hwid(or the License page in the admin UI, visible to the main admin) prints the fingerprint to send us; activation is a paste on the same page. Licensed installations verify the key online periodically. - A key that is invalid, expired or issued for another machine is refused at activation with a clear error. If an installed key later expires or the hardware changes, the Panel does not go down — it falls back to the free tier.
