mistgate

Mistgate is an open‑source, self‑hosted control panel designed for small VPN deployments. It lets you manage a handful of servers and distribute individual subscription links to family, friends, a community, or a small team. The project is released under AGPL‑3.0 and is currently in beta.

The panel runs on a single host and connects to VPN nodes over SSH. You add a node by entering its IP address and root password; the system pins the SSH host key, opens required ports in UFW or firewalld, and installs a signed agent binary. A one‑time install command is also provided for manual setups. Once nodes are registered, each user receives a unique link that aggregates all available servers. Compatible client applications such as Mihomo‑based apps (kl.ck, FlClash, Clash Verge Rev), Happ, and AmneziaVPN can read the link and automatically configure Hysteria2, VLESS REALITY, or AmneziaWG connections.

The panel performs health checks every five minutes, running 17 host checks on each node and offering seven automated fixes that require your confirmation. Alerts are sent to the administrator and can be forwarded to Telegram. If a direct path to a server is blocked, the panel can route traffic through another node, forwarding only encrypted data. It also supports optional reachability tests from inside specific countries using Globalping probes and block‑list checks, a feature that is primarily tuned for Russian networks. The software consists of two Go binaries (the panel and the node agent), uses SQLite for storage, and relies on systemd for service management. It runs with a memory footprint of about 16–20 MiB on a 1 vCPU/1 GB server.

Mistgate does not require Docker and avoids external database servers. Subscription links are delivered via a secret admin address, while a decoy site is shown to anyone who accesses the panel's public URL. A built‑in MCP server can expose fleet information to an AI agent, though actions that could affect the network still need admin approval. The current release (v0.1.0, dated 2026‑10‑03) includes Hysteria2 (UDP 443 with QUIC, Salamander obfuscation, port hopping), VLESS REALITY (Xray core, TLS over XHTTP or WebSocket), and AmneziaWG (versions 2.0 and 3.1, separate keys per device). Protocols such as VMess, Trojan, Shadowsocks, TUIC and plain WireGuard are not yet supported.

Key features