rospanel
Self-hosted VPN control panel built on Xray-core, supporting VLESS-Vision, VLESS-XHTTP-REALITY, Hysteria2, and AmneziaWG protocols with ACME TLS and custom inbounds.
Ficha actualizada 22 sept 2026, 18:44 · upstream 22 sept 2026, 18:02 · release v3.8.1
Qué es rospanel
Descripción editorial construida a partir del repositorio, su documentación y sus señales de mantenimiento.
RosPanel is a self-hosted VPN control panel built on Xray-core that provides a unified web interface for managing multiple servers. It eliminates the need to manually edit configuration files by generating complete configs from its state database. The system supports up to dozens of concurrent users, with each server instance handling full routing, statistics, backups, and branding. When one server becomes insufficient, additional nodes can be added seamlessly, creating a distributed network where all clients are served by every node simultaneously.
The architecture is designed for educational and research purposes, making it ideal for learning how to build your own VPN infrastructure from scratch. It avoids third-party dependencies such as nginx or certbot, instead issuing its own TLS certificates via ACME (Let's Encrypt) or generating self-signed ones for bare IP addresses. The panel maintains complete control over the entire stack — no reverse proxy is required since Xray listens directly on standard ports 443 and 80.
A key design decision is that the panel serves a decoy page at its root URL, meaning access without knowing the secret path yields nothing useful. This forces users to discover the correct endpoint through trial or error, which can be frustrating but also adds an element of discovery. The system supports both command-line installation and Docker deployment, with optional SSH-based agent installation for remote nodes.
Custom inbounds allow each server to handle specific protocols (VLESS, Trojan, Hysteria2) with full control over transport types, port numbers, REALITY keys, hop ranges, and fine-grained security options like XHTTP extra fields or HTTP masquerading. The config is validated locally before being persisted, ensuring that unsupported combinations are silently rejected rather than causing crashes.
The panel also includes a built-in probe detection mechanism that identifies IPs performing reconnaissance against the decoy site, recording them for operator review. Optional firewall rules can drop these probing IPs at the network level, and daily scanner digests provide visibility into what is being targeted without exposing sensitive in
- Educational project: learning how to build a self-hosted VPN from scratch using Xray-core
- Small office/home office (Soho) with 10-20 users requiring VLESS/Vision routing and Hysteria2 obfuscation
- Research or testing environment where you want full control over protocol selection, TLS handling, and custom inbounds without vendor lock-in
- Testing VPN clients to ensure compatibility with various protocols (VLESS, Trojan, Hysteria2, AmneziaWG)
- Network security research: analyzing how different routing protocols behave under load or when combined with obfuscation techniques
- Supports multiple protocols simultaneously (VLESS-Vision, VLESS-XHTTP-REALITY, Hysteria2) on a single server
- ACME certificate automation via Let's Encrypt eliminates manual SSL setup and domain management
- Self-contained binary with no external dependencies like nginx or certbot
- Supports both command-line installation and Docker deployment for easy scaling
- Custom inbounds allow per-server protocol-specific configuration (ports, keys, transport types)
- Built-in probe detection identifies scanning IPs against the decoy site without exposing sensitive data
- Self-hosted setup requires manual maintenance of systemd services and Docker containers
- No built-in user management or role-based access control — all users share the same admin interface
- Custom inbounds require manual configuration on each server; no automated provisioning
- Docker deployment does not support volume persistence across container restarts without explicit volume mounts
- No built-in backup mechanism for individual nodes beyond what Xray provides at the cluster level
Perfil de infraestructura
Estimación inicial derivada del repositorio y de los servicios detectados.
Despliegue detectado
Qué señales reales de instalación hemos encontrado.
Install via `curl -Ls https://raw.githubusercontent.com/AppsGanin/rospanel/main/install.sh | sudo bash` to get a systemd service and nftables package. For Docker, run `docker run --network host --cap-add NET_ADMIN --device /dev/net/tun ghcr.io/appsganin/rospanel:latest`. Always use `--network host` so Xray can bind to 443/TCP and Hysteria2 UDP ports directly; omit the device flag only if you never enable AmneziaWG. The panel requires root privileges for installation but does not store credentials on disk — SSH agent keys are used instead. After first login, a password change is forced and the secret path must be known to access the admin UI.
Stack y dependencias
Componentes inferidos a partir de manifests, configuración y documentación.
Puede sustituir a
Relaciones detectadas por el análisis del repositorio y su categoría.
Experiencia real de la comunidad
Ayuda a contrastar la estimación automática con instalaciones reales.
Todavía no hay datos comunitarios para este proyecto.