Install a node
Connect a server
- Open Nodes → Connect server. Enter a name, country and IP/domain without a scheme or port.
- Select a configuration profile and its active inbounds. The agent initiates connections to the panel; it needs no separate inbound management port.
- Copy the complete generated installation command. Run it as root on the node’s Debian/Ubuntu systemd server with outbound access to the panel and GitHub.
- The installer checks the node key, profile, selected inbounds, Xray checksum and executable startup before writing the service. The node environment is stored in
/etc/sn-node/node.env, mode 600. - Wait for a fresh agent report and confirmed Xray health. Publish a host and grant its inbound through the test customer’s internal squad.
- Import the customer subscription and make a real VPN connection. Confirm the exit IP and traffic counters.
An existing node/Xray installation is not overwritten by rerunning setup. Use the update instructions from the node card. A green agent status alone does not prove the engine, inbound port or VPN tunnel works.
Version selection
Open the Xray version selector. Review the installed, selected and available release versions. A pinned version stays selected until you change it; an empty pin uses the configured current release behavior. Test changes on one node before applying them to a shared profile or wider fleet. Engine restarts interrupt active connections.
If the GitHub release list is unavailable, inspect the error and current version rather than choosing a fabricated latest version. A version string must identify an actual XTLS/Xray-core release.
Update the agent
Use the update command generated by the panel for that node. The updater locates the installed executable through the service configuration, including older source deployments. Wait for the next report before changing Xray. The agent and engine are separate versioned components.
systemctl status sn-node --no-pager
journalctl -u sn-node -n 80 --no-pager
Check outbound HTTPS, the node secret, profile JSON and port conflicts if startup fails. Do not issue another node record solely to retry an interrupted connection.
Network information
In the node network tab, select Check network to query bgp.tools. The result includes resolved IP, ASN, operator and prefix, with links to route/RPKI information. Lookups are limited in frequency. A proxy address reports the proxy network; ASN information is not a VPN availability test.
Related: Profiles, Hosts, Internal squads.
Unassigned nodes and configuration testing
When connecting a server, leave “No profile” selected in the Configuration step, even if no profiles exist yet. Install the agent and wait for it to come online. It reports metrics without accepting VPN connections.
For an existing node, open its profile selector, choose “No profile” → “Apply”. After synchronization, the agent closes the previous VPN connections. The profile, hosts and squads are retained; this node’s inbound bindings are removed. If the node was used for a rehearsal, that trial finishes and its candidate profile is retained.
Open the profile you want to check → “Test-node rehearsal”, select the free online node and start the trial. “Finish trial” releases the node again. To return it to service, assign a profile and verify a test client connection. Schedule an interruption before releasing a node that serves customers.
Selfsteal: your own website on a node
If you closed the installation command
On the node card or in Diagnostics, click Installation command → Get a new command. The node, profile and settings are kept; the previous installation key stops working. Copy the new command and run it over SSH on the clean node server.
If the agent has already connected, opening the window does not replace its key. To move or reinstall it, use the separate Replace key action: after confirming, update the secret on the server.