A self-hosted control panel for running and managing Xray VPN subscriptions on a single server.
One binary. It runs the admin web panel, manages a local Xray-core process, serves universal subscription links, and drives an optional Telegram bot — all from a single Go binary.
🇬🇧 English · 🇮🇷 فارسی
More screenshots — subscriptions, inbounds, server, alerts, subscriber panel
Subscriptions — status, quota, expiry at a glance |
Inbounds — protocols, transports, per-inbound traffic |
Server — live CPU/RAM/disk, traffic, Xray process |
Alerts — rules and fired/resolved events |
Access history — searchable per-subscription domain log |
Subscriber panel — the self-serve page at /sub/{key} |
NasNet Panel (the nasnet-panel binary) is a single-server proxy management platform. One binary holds all state — users, subscriptions, and server configuration — and manages a local Xray-core process running as a supervised child process on the same host. It generates universal subscription links, exposes an admin web panel and a subscriber self-serve panel, and can drive an optional Telegram bot.
It is built for operators who run a proxy server and want one place to:
- configure inbounds, outbounds, and routing without hand-editing Xray config,
- hand out time- and traffic-limited subscriptions,
- give end users a self-serve experience through the subscriber panel or Telegram,
- and keep an eye on traffic, health, and system resources.
Everything ships in a single binary with the admin web panel and subscriber panel embedded — plus an optional bundled PostgreSQL and Xray-core for offline installs.
Proxy management (local Xray-core)
- 🔌 Protocols — VMess, VLESS, Trojan, Shadowsocks with TLS / REALITY / XTLS transports, plus WireGuard managed peers.
- 🧭 Routing & balancing — inbounds, outbounds, routing rules, and load-balancing rules, with geo-based (geoip/geosite) matching.
- 🩺 Supervised Xray-core — Xray runs as a managed child process with an auto-restart watchdog and in-panel version management (download / switch / update).
- 🖥️ Server operations — live web terminal, SSH management, access logs, traffic accounting, geofile management, host system stats, and a gated nuke/wipe.
Subscriptions & users
- 🔗 Universal subscriptions — a single base64 subscription link that auto-detects the client (v2rayNG, v2rayN, Clash, sing-box, Shadowrocket) and serves the right config and metadata.
- ⏱️ Time- and traffic-limited accounts — per-user subscriptions with expiry and data caps.
- 📲 Subscriber panel — a self-serve page at
/sub/{key}: live usage stats, QR codes, one-tap import to client apps, WireGuard devices, and optional chat with the admin.
Interfaces
- 🖥️ Admin web panel — a React SPA embedded in the binary (dashboard, server, users, subscriptions, settings, live terminal, charts).
- 🤖 Telegram bot — admin operations plus user-facing account and subscription info.
Operations
- 📊 Metrics & alerting — first-class Prometheus metrics and a built-in rule-based alert engine.
- 📨 Notifications — Telegram, Discord, and generic webhook channels.
- 🪵 Audit log & support chat — every admin action is recorded; users and admins can chat in-app (optional, off by default).
- 💾 Backup & restore for both PostgreSQL and SQLite.
- 🔒 Automatic TLS via ACME (Let's Encrypt), or bring your own certificate.
flowchart LR
Admin([Admin]) -->|Web Panel SPA| Panel
User([Users]) -->|Telegram Bot / Subscriber Panel| Panel
subgraph Server["Single Server"]
Panel["nasnet-panel<br/>(HTTP API · scheduler · embedded web + subscriber panel)"]
DB[("PostgreSQL<br/>or SQLite")]
Xray["Xray-core<br/>(child process)"]
Panel --- DB
Panel -->|manages + pushes config| Xray
end
Sub([Subscribers]) -.->|VPN clients| Xray
nasnet-panel— the whole application in one binary: HTTP API, embedded web panel + subscriber panel, Telegram bot, background scheduler, and the single source of truth (Postgres or SQLite). It supervises the local Xray-core process and pushes generated configuration to it in-process.- Xray-core — the proxy core, run as a supervised child process on the same host.
nasnet-tool.sh— an interactive installer/operations TUI (install, reconfigure, update, backup) for Docker or systemd deployments.
The codebase follows a clean, layered architecture (domain → usecase → repository → delivery) per feature. See docs/architecture.md.
🧭 New here? Follow the simple step-by-step Getting Started guide (فارسی) — it walks you through the whole install.
Requires a Linux server with Docker + Docker Compose. Default panel port is
9761.
# 1. Clone
git clone https://github.com/nasnet-community/nasnet-panel-linux.git
cd nasnet-panel-linux
# 2. Create your config
cp .env.example .env
# 3. Set the essentials in .env:
# - ADMIN_USERNAME / ADMIN_PASSWORD_HASH (generate the hash, see below)
# - JWT_SECRET_KEY (openssl rand -hex 32)
# - APP_BASE_URL (https://your-domain or http://your-ip:9761)
#
# Generate the password hash:
# htpasswd -nbBC 10 "" "your-password" | tr -d ':\n' | sed 's/$2y/$2a/'
# 4. Launch (PostgreSQL + app + Prometheus)
docker compose up -d
# 5. Open the panel
# http://your-ip:9761Prefer SQLite instead of PostgreSQL? Set DB_DRIVER=sqlite in .env and start with the override file:
docker compose -f docker-compose.yml -f docker-compose.sqlite.yml up -dOther install paths — guided installer (nasnet-tool.sh), systemd, prebuilt release binaries, and the offline bundle (with PostgreSQL + Xray included) are all covered in docs/installation.md.
| Interface | Who it's for | Notes |
|---|---|---|
| Web panel | Admins | Embedded SPA served at APP_BASE_URL. Full management + live charts and server terminal. |
| Subscriber panel | Users | Self-serve page at /sub/{key} — usage, QR codes, client import, WireGuard devices, optional support chat. |
| Telegram bot | Admins & users | Optional. Set TELEGRAM_ENABLED=true + a @BotFather token. Polling or webhook. |
| Subscription link | Any VPN client | /sub/{key} — universal base64 feed with client auto-detection. |
All configuration is environment-variable based (loaded from .env). The most important keys are the admin credentials, JWT_SECRET_KEY, APP_BASE_URL, and the database driver. The full annotated reference lives in docs/configuration.md and in .env.example.
| Guide | What's inside |
|---|---|
| Getting Started | Start here — simple step-by-step install for first-time users |
| Installation | Docker, systemd, the nasnet-tool wizard, release binaries, offline bundle, build from source |
| Configuration | Every .env variable, defaults, and what it does |
| Architecture | Single-binary design, layering, event bus, database |
| Server & Xray | Managing the local server, Xray-core process, and version updates |
| Protocols & Routing | Inbounds, outbounds, REALITY, WireGuard, routing & balancing rules |
| Subscriptions & Clients | Subscription links, formats, supported client apps |
| Telegram Bot | Bot setup, webhook vs polling |
| Admin Panel | A tour of the web panel |
| TLS, ACME & Domains | Automatic and manual certificates, reverse proxies |
| Monitoring & Alerting | Prometheus metrics, alert rules, notifications |
| Backup & Restore | Database backups and restore |
| Development | Project layout, building, frontends, protobuf, tests |
| Troubleshooting & FAQ | Common problems and answers |
Backend Go 1.26 · Gin · GORM (PostgreSQL / SQLite) · Cobra · Xray-core · Prometheus client · telebot Frontend React 19 · Vite · TypeScript · Tailwind · Radix UI Infra Docker / Docker Compose · systemd · ACME (Let's Encrypt)
Contributions are welcome. Start with the development guide for project layout, build instructions, and how to run the test suite. Please open an issue to discuss substantial changes before sending a PR.
Licensed under the GNU Affero General Public License v3.0. See LICENSE.
In short: you may use, modify, and redistribute this software, but if you run a modified version as a network service, you must make your source available to its users.