Operations

autoscript CLI

Every Vortexa panel install ships a small on-VPS admin shell, backend/cli.sh, installed as /usr/local/bin/autoscript. It is the only supported way to reset admin credentials, rotate the panel domain/port/secret path, pull an official release, back up panel state, and repair the VPN service stack without SSHing into the database directly.

How to launch it#

The CLI must run as root. It reads its configuration from /etc/autoscript/agent.env (ENV_FILE) and refuses to start if that file is missing — it means install.sh has not run yet on this box.

interactive menu

sudo autoscript

Every menu action is also available as a single non-interactive subcommand, so it can be scripted or run over a one-shot SSH command:

non-interactive flags

sudo autoscript status
sudo autoscript update
sudo autoscript backup
sudo autoscript restart
sudo autoscript logs
sudo autoscript maintenance on|off|status

Identity is locked

BRAND_NAME and OFFICIAL_REPO_URL (https://github.com/Ghostrelicc/Vortexa) are hardcoded in the script, not read from config — they are treated as part of the project, not something an install can override.

Menu reference#

Running autoscript with no arguments (or autoscript menu) shows a numbered menu. Table below maps every entry to its underlying non-interactive flag and to what it actually executes.

#	Menu label	Flag	What it runs
1	Show status	status	Prints panel URL, admin user, DB path, repo/release info, then the live state of xray/autoscript-agent/autoscript-web/autoscript-ssh-ws/autoscript-bot/nginx/fail2ban via systemctl is-active.
2	Reset admin username	reset-user	Prompts for a new username (regex-validated), writes it to agent.env and the settings table, then restarts the stack.
3	Reset admin password	reset-pass	Prompts twice (or auto-generates 18 random alphanumerics if left blank), hashes with argon2, updates ADMIN_HASH in agent.env + settings, restarts the stack, and prints the generated password once if auto-generated.
4	Change panel domain / TLS mode	set-domain	Prompts for a new domain and TLS mode (single-domain or wildcard), updates agent.env/settings, re-runs backend/scripts/apply_settings.sh to reissue TLS and reload nginx, then restarts the stack.
5	Change panel port	set-port	Prompts for a port (or auto-picks a random 20000-60000 port that avoids the Cloudflare/Xray ports), opens it in ufw, closes the old one, restarts autoscript-agent.
6	Change panel secret path	set-path	Prompts for a URL path slug (blank = random 14-char slug, - = disable), updates PANEL_PATH, restarts autoscript-agent.
7	Show release / update channel	release	Prints the official repo URL, the installed release (git describe --tags), and the latest published GitHub release tag; flags an unofficial git remote.
8	Update to latest official release	update	Runs the full release-only update flow — see Updates & releases.
9	Restart services	restart	Runs restart_stack(): shows the maintenance page, enables/restarts every service (mode-aware for local-node installs), reloads nginx, restarts autoscript-agent, polls the web port until it answers, then lifts maintenance.
10	View service logs	logs	Sub-menu: 1) agent 2) ssh-ws 3) bot 4) nginx 5) ip-limit 6) xray — runs journalctl -u <unit> -n 200 --no-pager for the chosen unit.
11	Backup /etc/autoscript + xray config	backup	Runs backup_now() — see Backups & restore.
12	Set Telegram bot token / admin id	set-bot	Prompts for a bot token (blank disables it) and an admin chat id, writes bot.token/bot.adminChatId/bot.enabled settings, restarts autoscript-bot.
13	Repair xray / SSH-WS / nginx	repair / repair-services	Runs repair_services(): reinstalls openssh-server/curl/nginx/stunnel4/fail2ban, re-runs setup_xray.sh, setup_stunnel.sh and apply_settings.sh, then enables+restarts the whole VPN service set (mode-aware).
14	Update ALL nodes	update-nodes [ids]	Prompts for a comma-separated list of node ids (blank = all enabled, non-master nodes) and fans out the RPC agent.update to each one in parallel — see Updates & releases.
15	Uninstall panel	uninstall	Requires typing UNINSTALL to confirm, then execs backend/uninstall.sh.
0	Exit	—	Exits the menu loop.

What 'Update to latest official release' actually does#

update_now() is the single most involved action in the CLI. It is documented in full on /docs/updates; in short it: refuses to run on a modified/rebranded remote (check_authenticity), pins origin back to the official repo, diffs the installed release tag against the latest GitHub release, fast-forwards the git checkout to that tag, purges all old code/build artifacts (purge_old_code, data directories untouched), runsbackend/scripts/migrate.sh, refreshes the SSH MOTD helper, reinstalls Python/APT dependencies, refreshes systemd unit files, rebuilds the web UI from a clean tree (build_web_ui), and only then restarts the live stack.

update-nodes: fleet-wide agent update from the CLI#

How it authenticates

update_all_nodes loads the node roster straight from the panel's own SQLite (nodes.v1 key) or its JSON fallback, mints a short-lived HS256 JWT signed with the panel's own JWT_SECRET, and calls the panel's own local RPC proxy with that token — it does not talk to nodes directly, and refuses to run if JWT_SECRET is unset.

Scope

With no argument: every non-master node whose status is not disabled.
With a comma-separated id list: only those node ids.
Runs updates concurrently via a thread pool, then exits non-zero if any node failed.

maintenance: on / off / status#

autoscript maintenance on writes /etc/autoscript/maintenance and sets a MAINTENANCE_STICKY flag so the sentinel file survives the script exiting — the operator has to explicitly run autoscript maintenance off to clear it. Every other action (update, restart, repair) also toggles the maintenance page automatically around itself, but always clears it on exit (via an EXIT/INT/TERM trap) unless the sticky flag is set, so a crashed update can never leave the panel stuck behind the maintenance page indefinitely.

bash

sudo autoscript maintenance status
sudo autoscript maintenance on
sudo autoscript maintenance off

restart_stack(): what 'restart' really touches#

Shared by the restart menu entry, the update flow, and the repair flow. It is mode-aware — a single-box install (with a built-in local node) manages a different service list than a bare panel-only install:

Local-node install: Disables/masks the legacy autoscript-ip-limit timer+service, then enables+restarts autoscript-web, autoscript-ssh-ws, autoscript-bot, autoscript-stunnel, xray, nginx, fail2ban.
Panel-only install: Enables+restarts the same set PLUS autoscript-ip-limit.service/.timer (the legacy single-box per-UID shaper is still in use here).
Always: systemctl reload-or-restart nginx; systemctl restart autoscript-agent; then polls http://127.0.0.1:<WEB_INTERNAL_PORT>/ for up to 45s before lifting maintenance, so the first real navigation is never a 502.

repair_services(): the fix-it button#

1
Reinstalls openssh-server curl unzip ca-certificates nginx stunnel4 fail2ban via apt.
2
Enables sshd (ssh, falling back to sshd).
3
Re-runs backend/scripts/setup_xray.sh if present.
4
Re-runs backend/scripts/setup_stunnel.sh and apply_settings.sh if present.
5
Mode-aware enable+restart of xray, autoscript-web, autoscript-agent, autoscript-ssh-ws, autoscript-bot, autoscript-stunnel, nginx, fail2ban (plus the legacy ip-limit unit on panel-only installs).

When to use it

Reach for repair before update when only the VPN service plane looks broken (Xray won't start, stunnel is down, nginx config drifted) and you don't need new code — it is far faster than a full release update because it never touches the web bundle.

Services and systemd units the CLI manages#

Unit	Role
autoscript-web.service	The panel's built-in web UI process (single-box installs).
autoscript-agent.service	The Python backend API the panel UI and bot both call.
autoscript-ssh-ws.service	SSH-over-WebSocket bridge.
autoscript-bot.service	The Telegram bot process.
autoscript-stunnel.service	stunnel4 for SSH-over-TLS on 445/447/777 (panel-side; same role as the node-side unit documented in Nodes).
autoscript-ip-limit.service / .timer	Legacy single-box per-UID speed/session shaper — only active on panel-only (non local-node) installs; disabled and masked automatically once a local node is enabled.
xray.service	Xray-core VMess/VLESS/Trojan.
nginx.service	TLS termination + reverse-proxy fan-out.
fail2ban.service	Brute-force protection for sshd/nginx.
ssh / sshd.service	Native OpenSSH.

Updates & releases

The full release-only update flow, in depth

Backups & restore

What backup_now() captures and how to restore it

Troubleshooting

Symptom-to-fix reference with exact commands