Architecture

                      ┌───────────────────────── MASTER VPS ─────────────────────────┐
  browser ──HTTPS──▶ │  nginx  ──▶  web console (autoscript-web)                     │
                     │            └▶ FastAPI agent API (autoscript-agent) ──▶ SQLite │
  Telegram  ────────▶│  telegram bot (autoscript-bot)                                │
                     │  local node "local-01"  (always online while panel runs)      │
                     └──────────────┬──────────────────────────────┬─────────────────┘
                                    │ mTLS RPC (panel → node)      │ signed heartbeat (node → panel)
                     ┌──────────────▼──────────────┐  ┌────────────▼────────────────┐
                     │  NODE VPS (agent)           │  │  NODE VPS (agent)           │
                     │  xray · ssh/dropbear ·      │  │  ssh-ws · zivpn · nginx     │
                     │  stunnel · nginx            │  │                             │
                     └──────────────┬──────────────┘  └────────────┬────────────────┘
                                    │  VPN traffic                  │
  end user client ─────────────────▶┴───────────────────────────────┘

• The master never runs the standalone node code from node/ — it auto-registers itself as local-01 and is considered online while the panel process is up.
• Only remote worker boxes run the node agent, installed with the node one-liner.
• End-user VPN traffic goes straight to the node it was provisioned on. The panel is a control plane, not a data path.

The installer deploys everything as systemd units. Knowing the unit names is most of troubleshooting.

systemctl status autoscript-agent autoscript-web autoscript-bot nginx
journalctl -u autoscript-agent -n 200 --no-pager

# on a node
systemctl status autoscript-node
journalctl -u autoscript-node -f

/opt/autoscript

Checked-out release: backend, node payload, built web bundle

/etc/autoscript/agent.env

Master environment: panel port, path slug, secrets (root-only)

/etc/autoscript/db.sqlite

Default database path (chosen at install)

/etc/autoscript/panel-credentials.txt

Generated panel URL + admin credentials, mode 600

/etc/default/autoscript-node

Node environment: NODE_ID, MASTER, AGENT_PORT

/usr/local/bin/autoscript

Admin CLI

/root/autoscript-backup-<timestamp>.tar.gz

Default location for panel backup archives

/var/log/autoscript-repair.log

Output of the automatic service-repair routine

The installer resets ufw to deny-inbound and then opens exactly what the stack needs. Panel and local-node API ports are randomised so they never collide with the CDN-friendly VPN port sets.

• SQLite on the master is the single source of truth for accounts, nodes, plans, invoices, wallets, settings and audit logs.
• Nodes hold derived state only: Xray config, SSH system users, ZIVPN users.json, certs. Anything on a node can be rebuilt from the panel by re-syncing.
• Counters are deltas. Node agents scrape cumulative traffic counters and report deltas, so a service restart or counter reset does not double-count or go negative.

Every master/node interaction goes through a small, fixed contract. Node → master calls land on public routes; master → node calls hit the agent's mTLS RPC server.

Besides the request path, the master runs scheduled work. Most “it fixed itself” behaviour comes from these.