Overview

Warning

THIS REPOSITORY IS AN EDUCATIONAL EXAMPLE FOR LEARNING NGINX, REVERSE PROXY AND NETWORK SECURITY BASICS. THIS SCRIPT DEMONSTRATES NGINX CONFIGURATION AS A REVERSE PROXY. NOT FOR PRODUCTION USE! IF YOU DON’T UNDERSTAND HOW THE CONTROL PANEL WORKS - THAT’S YOUR PROBLEM, NOT THE SCRIPT AUTHOR’S. USE AT YOUR OWN RISK!

The script installs the Remnawave panel, a node and a reverse proxy on NGINX and Xray in one command. Xray runs directly on port 443 and hands traffic to NGINX through a Unix socket: with no extra TCP hops, connections come out faster and more reliable.

Important

The script works on Debian and Ubuntu and has been tested on KVM virtualization. You need your own domain and root on a freshly installed system. The details are collected on the Requirements page.

Deployment modes

Single server

The panel and the Xray node live on one machine. Suits compact installations with moderate traffic: a single server covers everything.

Distributed

A panel server without a node and a separate node server with a SelfSteal stub for VLESS Reality. There can be as many nodes as you need, the panel is one.

Panel access protection

At installation the script asks how to protect the panel. The default is a secret link:

https://panel.example.com/auth/login?<SECRET_KEY>=<SECRET_KEY>

The link sets a cookie in the browser, and without the correct pair the panel looks like a blank page. The two other options put a login page in front of the panel:

Cookie protection

The cookie name and value equal the secret key. Scanners do not detect the panel, path brute-forcing runs into a blank page.

ModedefaultWeb serverNGINX or CaddyWithout the keyblank page or 404

TinyAuth

A login page comes up on a separate subdomain in front of the panel: the script sets its login and password during installation.

Web serverNGINXLogin pageauth.your-domain

Caddy with MFA

The panel hides behind a login page with two-factor authentication: MFA is enabled after the first login.

Web serverCaddyImagecaddy-with-authLoginusername, password and an MFA code

Features

Subscriptions

Client configurations update through the subscription: add a host in the panel, the client picks it up on its own.

JSONwith format conversion for popular clientsSubscription pageyour own, on your domain

NGINX and the socket

Xray takes port 443 and talks to NGINX through a Unix socket instead of a TCP loop.

Port 443Xray directlyLinkUnix socketEffectless TCP overhead

Security

The script’s base: the firewall, certificates and masking are configured at installation.

FirewallUFWCertificatesCloudflare or ACME, auto-renewalIPv6leak protectionTCPBBR algorithmMaskinga random site template

Modules

Everything above is what the script does at installation. Then come the modules: each opens from the main menu and is covered in detail on its own wiki page.

Warp Native

Node outbound traffic through Cloudflare WARP.

Node plugins

Torrent Blocker plus ingress and egress traffic filters.

Xray Checker

Proxy host checks and a public status page.

SSH access to servers

Manage the whole fleet from one menu.

Server routing

Node traffic through a bridge to a separate exit server.

Client balancer

Host groups with automatic switching in the Mihomo subscription.

Subscriptions and rules

Strict response rules: browsers, webviews and known clients.

NetBird module

A private network for the panel and nodes without public ports.

Backup and restore

Panel backups and migration to a new server.

Questions and support

Found a problem

Open an issue in the repository or discuss it in the community Telegram chat.

GitHub IssuesTelegram

Support the project

The project is free and developed in spare time. A donation funds future updates and improvements.

TON USDTUQAxyZDwKUPQ5Bp09JOFcaDVakjYQT46rf3iP3lnl_qc9xVS