Accounts & delivery

Hosts & CDN

Two related modules decide what a client actually dials: Addresses (Hosts) sets the hostname per protocol and transport, and CDNs adds edge endpoints that front your nodes.

The Cloudflare-friendly port sets#

Vortexa keeps two fixed port sets so accounts can always be placed on a port a CDN will proxy. Anything outside these sets is rejected (silently zeroed) when set as an account’s preferred port.

Set	Ports
TLS	443, 2053, 2083, 2087, 2096, 8443
Plain (nTLS)	80, 8080, 8880, 2052, 2082, 2086, 2095

These are opened by the installer’s firewall step and are also the port list SSH accounts are allowed to forward to.

Addresses (Hosts)#

What it does

For every protocol × transport combination you can pin the literal hostname or IP that appears in generated configs — globally, or overridden per node. It is a pure address/labelling layer: it does not open ports or install certificates.

Resolution order

node override: Wins for that node only, when the Override checkbox is ticked.
global address: Used when there is no node override.
node domain: Fallback: the node’s own VPN domain.

Each row shows the effective address and a badge telling you which layer is winning: global, node override or node domain.

How to set an address

1
Open Hosts.
2
Under Global address, expand a protocol and type a host into the transport row you want — for example VLESS · WebSocket → ws.example.com. Press Enter or Save.
3
Clear the field and save to remove the slot and fall back to each node’s own domain.
4
To override a single node, expand its card, tick Override on the row, type the node-only host and save. Untick to revert.

Empty node card?

A node shows “No Xray transports enabled on this node” unless it has the Xray protocol and at least one transport enabled.

CDN endpoints#

What it does

A CDN entry lets clients dial an edge hostname (Cloudflare, Bunny, GCore, Fastly, …) instead of the node directly. The edge hostname is surfaced in generated connection profiles and in Telegram delivery messages.

Fields

Field	Meaning
name	Cosmetic; appears in profile labels as username-<Name>.
url	The edge hostname clients dial, pointed at your CDN provider by your own DNS.
protocols	Subset of `ssh` and `xray`. One entry cannot mix both.
xrayProtocols	Which of VLESS / VMess / Trojan this endpoint may serve.
transports	Subset of `ws`, `httpupgrade`, `xhttp`. Raw TCP and gRPC cannot be CDN-proxied and are hidden.
address	Origin / Host header the CDN forwards to. Defaults to the panel domain and is also the default SNI.
sni	Optional TLS SNI override.
tlsOnly	true = HTTPS/443 TLS mode (requires a wildcard certificate); false = plain HTTP/80 “nTLS”.
nodeIds	Empty means every node offers this CDN.
accountIds	Empty means every account with a matching protocol may use it.
enabled	Turn the endpoint off without deleting it.

How to add a CDN endpoint

1
Point a hostname at your CDN provider and configure the provider to forward to your node/panel hostname.
2
In the panel open CDNs → Add CDN and pick the group: Xray CDN or SSH CDN.
3
Fill in the name and the CDN host clients will dial.
4
For Xray endpoints set the origin address (Host header) and, if needed, an SNI override.
5
Choose security: TLS (443, needs a wildcard certificate) or nTLS (80, plain).
6
Tick the allowed transports and Xray sub-protocols.
7
Restrict attached nodes and assigned users, or leave both empty for “all”.
8
Save, then add the CDN id to the accounts that should use it — per account in Settings, or globally via a plan’s default CDN list.
9
Optionally set cdnOnly on the account to hide the direct config entirely.

CDN endpoints

GET    /api/cdns
POST   /api/cdns          requires name + url
PATCH  /api/cdns/{id}
DELETE /api/cdns/{id}     also scrubs the id from every account and plan

Deleting a CDN rewrites accounts and plans

Deletion removes the id from every account’s and plan’s CDN list, and force-clears cdnOnly on any account left with no CDNs. The audit log entry cdn.delete records the affected counts.

SSH CDN entries have no transport or TLS controls — they inherit the SSH-over-WS listener’s own security profile and only supply an extra hostname.
Without a wildcard certificate the security picker locks to nTLS and shows an explanatory banner.

Recipes#

Cloudflare-proxied VLESS on 443

1
Add an orange-clouded DNS record for the VPN hostname (never for the panel host).
2
Create an Xray CDN entry: host = the proxied hostname, origin = your node hostname, security = TLS, transports = WS (and HTTPUpgrade if your clients support it).
3
On the account set cfTlsPort = 443 and attach the CDN id.
4
Regenerate the config and test from a filtered network.

Plain-HTTP fallback for restrictive carriers

Create a second, nTLS CDN entry on port 80 with the same origin and hand it out as an alternative profile. Carriers that break TLS SNI often still pass plain HTTP upgrades.

Routing & blocklist

Egress, DNS, ports, domains.

Nodes

Where these addresses point.