Machines
Dashboard
Section titled “Dashboard”The dashboard home page (https://app.nx.3fe.ru/) shows cards for all machines in your organization. Each card includes:
- Online / Offline: presence. Online means the agent currently maintains a connection to the control server. Status updates arrive as events without reloading the page. Offline status includes the last connection time, such as “last seen 3 days ago”, and preserves the last known OS and agent version instead of showing an empty card.
- Login, Hostname, and agent Version.
- Active sessions, with a list and a Connect button for each.
- Launch shell: open a new terminal with one click.
Click a card’s heading to open the machine page. It shows the same fields plus Status (whether the record is enabled), release Channel, Update policy, sessions with Connect and Stop buttons, and New session.
When session previews are enabled, the card shows a live mosaic of each session’s output. See Terminal and sessions.
Search, filters, and groups
Section titled “Search, filters, and groups”A shared filter bar appears above the list, and is also used in New session, Tunnels, and administration:
- Search: by name, hostname, and tag.
- Online only: hide disconnected machines.
- Tag chips: click a tag to keep only matching machines; combine several tags if needed.
- Group by: any tag key (
env,client,role, etc.). Machines without that tag go into a “no tag” group. - Reset: clear all filters. The “N of M” counter shows how many machines remain.
Filter state is synchronized with the URL, for example /?tags=env:prod&group=client. Bookmark the link or share it with a colleague to show the same selection.
Tags are the only grouping mechanism; there is no folder hierarchy. A machine can belong to a client, environment, and role at once, whereas a tree would force one primary axis. The convention is key:value:
env:prod env:stage client:acme role:db site:mskNormalization rules: tags are lowercased, whitespace is trimmed, and duplicates are removed. Allowed characters are a-z 0-9 . _ : / -, with up to 64 characters per tag and 32 tags per machine.
Admins and owners can edit tags in Admin → Agents by clicking tags… in the Tags column. Selected tags appear as removable chips. Tags already used by other machines and enrollment tokens are offered below to prevent typos. Type a new tag and accept it with Enter, a comma, or a space; Backspace removes the last tag. The same editor is used in enrollment-token creation. Saving replaces the old tag set completely.
Admin → Agents
Section titled “Admin → Agents”The organization’s agent table has these columns: ID, login, hostname, display name, Platform (OS and architecture, shown for online machines only), Version, Presence, Status (Enabled / Disabled), Relay, Access, Tags, release channel, and update policy.
Machine actions:
- Rename: set a display name instead of the login.
- Relay On/Off: allow other agents in the organization and
nyx-operatorto reach this machine’s loopback ports through the control plane. See SSH relay and tunnels. - Access: Managed grants permanent access to organization operators; Code only grants access only through owner consent. See Access by consent code.
- Update policy (
manual/auto/auto_idle_only) and Channel (stable/canary). - Worker root: temporarily grant sudo to
nyx-worker(Linux only). See Linux installation. - Skills: enable MCP servers from the catalog published by the machine.
- Disable / Delete: a disabled agent cannot connect but its record remains; deleting it permanently invalidates its credentials.
Register agent creates a record with a login and one-time password. This is the older method; use tokens for new machines.
Enrollment tokens
Section titled “Enrollment tokens”The Enrollment tokens section is on the same page. A token has these settings:
| Field | Meaning |
|---|---|
| Max uses | 1 for one machine, more for a fleet rollout with one command |
| Lifetime (hours) | The token becomes unusable after expiry, even with uses remaining |
| Hostname pattern | Accept only machines with a matching hostname |
| IP list | Accept enrollment only from these addresses |
| Tags for new agents | Every enrolled machine receives these tags |
| With relay | Enable Relay immediately on new machines, needed for SSH through the control plane, especially on Windows |
After Create token, the dashboard shows nythronix-agent enroll --token … --url … once, alongside the Windows installer link. The table below lists issued tokens, use counts, expiry, and a Revoke button.
Revoking or exhausting a token does not affect enrolled machines: they have their own permanent credentials.