Contents
Getting started
10-minute quick startArchitecture
Install and upgrade
Install the controllerAdd nodesOnline upgradesUninstall and migrate
Sites
Add a siteSet up the CNAME recordHTTPS certificatesCache rulesPurge and prefetchOrigin settings
Security
Security overview and big screenAttack logCC protectionWAFLists and access controlBots and scannersPaid protection add-ons
Analytics and alerts
StatisticsAccess logsAlerts and notifications
Accounts and licensing
Users and plansLicenses and add-ons

Add nodes

About 5 minUpdated 2026-10-28

A node is the machine that carries visitor traffic. Once the controller is installed, get a command in the panel and run it on the new machine. After you approve it, the node fetches its configuration and comes online.

Requirements

  • Debian 12 / 13, or Ubuntu 24.04 / 26.04 and later, x86_64 or arm64, with systemd; run as root.
  • A clean system: no pre-installed nginx / OpenResty, and ports 80 and 443 must not be taken by other programs.
  • The node can reach ports 7443 (node communication), 7444 (upgrade package delivery) and 7445 (log ingest) on the controller, and opens the ports it serves (usually 80 / 443).
  • Do not install it on the controller machine.

Get the command

Go to Node Management › Pending Setup, click + Add Node, and click Copy command in the dialog. The token in the command is one-time and valid for 30 minutes; one command installs one node.

Run it on the node

Paste and run it as root on the new machine. The installer runs pre-checks first: if anything fails, it lists every problem and exits without changing the machine. After that it downloads the node package and verifies the signature; a bad signature is always refused. The last line NODE_INSTALL_DONE <version> means it is installed, and the node ID is shown on screen.

Tip Running it right after getting the command is fine: the controller allows the node automatically, and the script waits up to 3 minutes, retrying every 5 seconds.

Approve

Back in Node Management › Pending Setup, the new node is listed; initialize (approve) it. You do not need to log in to the node again: within seconds it gets its certificate, pulls its config and starts services, and shows as Online in the node list.

Caution If the controller address in the command is a local or private address, two # 【警告】 warning lines appear before the command. First set the node communication address under System › Maintenance Operations and get the command again; otherwise nodes elsewhere probably can't reach the controller.

FAQ

  • Token expired: click Add Node again for a new command.
  • Interrupted halfway: re-run the same command. Finished steps are skipped and missing ones filled in; the node identity stays the same.
  • Clock not synchronized: the script warns you; once online, the node corrects its clock against the controller every 10 minutes. If your network blocks UDP 123, open it.
  • Taking a node out: see Uninstall and migrate.