multi-node

Probe the connection first with test_node using the same address, port, scheme, and token you plan to save, then call add_node which probes again during the write. Afterward use list_node_inbounds to see what the node offers and choose a sync mode.

Call get_node_mtls_ca on the master to mint the node-auth CA, then set_node_mtls_trust_ca with that CA on the node's panel, and finally set the node's tls_verify_mode to mtls on the master. After rotating a client certificate, reload_node_mtls_client applies it without a restart.

Use pin mode for self-signed certificates, which covers most private clusters. Read the fingerprint with get_node_cert_fingerprint or get_remote_cert_hash, store it in pinned_cert_sha256, and re-pin after every certificate renewal.

Node tools require panel version 3.5.0 or later, and reload_node_mtls_client requires version 3.7.0 or later. From version 3.6.0 the panel reports only hasApiToken and never returns the token value.

delete_node removes the node but does not migrate its inbounds, so clients served there lose their route. Move those clients to another node first or accept the outage knowingly.

The probe rejects nodes on private or loopback addresses unless allow_private_address is set, which protects against accidentally pointing a node at the master itself. Set that flag explicitly for nodes on internal networks.