Nodes

A node is a server that runs the Mistgate agent, mistgate-node. The panel tells the agent which profiles to run, and the agent reports back its state, its traffic and what it sees on the host. This page walks through the Nodes section and a node's page tab by tab. To connect a new server, see Add a node.

The Nodes list#

The header says how many nodes there are, how many people are online and how many nodes have problems ("3 nodes · 12 online · 1 with problems"). Add node opens the dialog that makes the install command.

Above the table:

• the status chips All, Problems and Healthy, each with its count;
• All protocols: shows only the nodes that run a profile of one protocol;
• All countries: shows only the nodes of one country.

On a phone the table becomes one card per node with the same facts. The list refreshes every 10 seconds. Retired nodes are not listed.

A healthy node whose agent is older than the version this panel ships reads Healthy · outdated agent with its version; the line is a link to Updates. See Updates.

Node statuses#

Problems are the red statuses and Needs attention, except the clock warning: that one is shown but not counted. These counts appear in the header of the list, on the Overview and in the menu.

A node's page#

The header shows the country code, the name, the status, and a WARP chip when the node has a WARP account (the chip reads the Cloudflare data centre while WARP works and links to the WARP card). Under the name: the location, the provider, the address, the agent version, and outdated agent when there is a newer one.

Two buttons sit on the right:

• Restart profiles restarts every profile of the node. The dialog says how many people drop for a few seconds; they reconnect by themselves. The button is off while the agent is not connected or the node has no profiles.
• Doctor opens the Doctor tab.

Under the header a banner explains the current state with the action that helps:

The command of the "Unreachable" banner, to run on the node over SSH:

systemctl restart mistgate-node && journalctl -u mistgate-node -n 50 --no-pager

The page has seven tabs: Overview, Profiles, Users, Logs, Events, Doctor and Settings. The Profiles tab shows how many profiles failed to start, the Doctor tab how many items need attention.

Overview#

• CPU, RAM, DISK, NETWORK: the latest readings. The CPU bar shows the softirq part (network interrupts) in a second colour, with the vCPU count and the load. Readings arrive a few seconds after the agent connects; an offline node keeps its last readings and says since when it is offline.
• Traffic · 24 h: hourly traffic through the node.
• Alerts: the open alerts of this node, with the same buttons as on the Health page, and the last three that closed. All alerts opens the Health page. The card is hidden when there was nothing.
• Client-eye checks: one row per profile with its latency and exit IP, or why it fails. A click on a row opens its 24-hour history. Check now starts a round for this node.
• Online by protocol: people connected now, per protocol.
• Host facts: hostname, OS, kernel, architecture, CPUs, RAM, disk, virtualization, IPv6, boot time and the engine versions.

The checks, alerts and the doctor are described in Health.

Profiles#

Every profile on the node is a row. The name links to the profile; under it is the protocol.

For Hysteria2 the row shows:

• Port: the UDP port on this node;
• Domain (SNI): the server name in the certificate;
• Certificate: the expiry date (amber with less than 14 days left, red with less than 3), self-signed, pinned, or none: the profile is not running.

For AmneziaWG the row shows Port, Backend (kernel or userspace, with its version), Egress (Direct or WARP) and Devices ("5 · 2 online"), and a status line with the last handshake.

On the right is the state: Running, Starting, Failed to start or Off. A profile that failed shows the cause in words and the agent's own error text under it. When the cause is clear, a button fixes it: Change port (the dialog opens on a free port), Set the domain, or Open WARP.

Each row has:

• Edit: the port and the Domain (SNI) for this node only, and the Enabled switch. A profile switched off stays on the node but leaves the subscriptions.
• Restart: restarts only this profile. Its connections drop for a couple of seconds.
• Remove: takes the profile off the node. The dialog says who notices: the users who lose the node at their next subscription update, or, for AmneziaWG, the devices that stop working. Their keys work again if you put the profile back on the same node.

Add profile opens the dialog that puts a profile on this node: see Profiles. When the panel has no profile at all, the dialog offers to create a Hysteria2 profile on port 443 (or the first free port) and put it on the node in one go, with Set up by hand as the other way.

Users#

• On this node now: who is connected, with the device model, the protocol and the current download speed.
• Top today: the ten people with the most traffic through this node since 00:00 UTC.

Logs#

A live tail of the agent and its engines, relayed by the panel. The last 200 lines arrive first, then new lines as they are written; up to 1000 lines stay on screen.

• All, Info, Warn, Errors filter by level; Search the log filters by text.
• Pause freezes the screen while new lines keep arriving; Resume shows them.
• Download saves what was received as <node>-agent.log.

The tab works while the agent is connected (Healthy or No traffic). If the link drops, it reconnects every 5 seconds. Only the owner can read the logs: they contain client addresses.

Events#

The history of the node, grouped by day: connected, went quiet, came back, profiles added, started, failed and restarted, settings applied, agent updates and rollbacks, certificate renewals, the AmneziaWG module build. Related events are joined into one line.

The chips All, Problems, Profiles and Agent filter the list. Details opens the raw events behind a line: the event code, the exact time, the source (node agent, panel or admin action) and the parameters. Show more loads older events; when a filter finds nothing among the latest ones, Search further does the same.

Doctor#

The node's own host checks, grouped into Needs attention, Accepted as normal, All good and Not checked, with the fixes the panel can apply and the manual steps for the rest. Run again asks the node for a fresh report. The first report comes about 30 seconds after the agent connects; an agent that is too old for the doctor gets a link to Updates. See Health.

Settings#

The tab holds, top to bottom, the WARP card, the node's fields, the AmneziaWG backend card and the Danger zone. WARP is described in WARP, the backend in AmneziaWG.

Save sends only what changed; the node gets the new settings at once, without a reconnect.

DNS for user traffic is not the same as the server's own resolver that the doctor checks, and not the same as the DNS presets that apps receive: see DNS.

Renaming a node#

Change Name and save. The name shows in the panel, in the file names of AmneziaWG configs, and in the server names of the apps only when the name template uses {node} (the default template uses the country). See Subscriptions.

Danger zone: retiring a node#

Retire from fleet removes a node for good. The dialog lists what happens:

• users stop getting the node in their subscription; their links stay the same;
• the node's certificate is revoked and its agent is told to stop; the files on the server stay;
• the node's record stays in the audit log, with its traffic history.

To confirm, type the node name. After that the node disappears from the list; its page, if you open it, says "This node is retired". A retired agent cannot connect again. Only the owner can retire a node.

There is no other way to delete a node: retiring is the removal. To clean the server afterwards, as root:

systemctl disable --now mistgate-node
rm /etc/systemd/system/mistgate-node.service /usr/local/bin/mistgate-node
rm -r /var/lib/mistgate-node

The paths are the defaults of mistgate-node install; if you installed with other --bin or --state-dir values, use those.

Agent version and drift#

• Outdated agent. The panel knows the newest agent version it ships. A node that runs an older one is marked outdated agent in the list and in its header. Some features need a newer agent: the doctor, WARP, the automatic AmneziaWG module build. Update it from Updates.
• State drift. The panel sends every node its full desired state and compares a hash of it with what the node applied. When they differ, the panel sends the state again (event "state drifted from the panel, resent"). If the node still applies a different state, it reads Needs attention with "the node's state differs from the panel's", and an alert opens. Restart the profiles; if it comes back, read the node's log.
• Clock skew. When the server clock differs from the panel's, the node says so. A wrong clock breaks certificates and handshakes; turn on time sync on the server (timedatectl set-ntp true).

Who can do what#

Every admin sees the nodes. The owner and helpers can change a node's settings and restart its profiles. Making install commands, retiring nodes, reading logs, putting profiles on nodes and building the AmneziaWG kernel module are for the owner only. See Security.