Frequently asked questions

How do you pronounce Nythronix?

Nythronix is pronounced /naɪˈθrɒnɪks/ — roughly nye-THRON-ix.

Does a machine need a public IP or port forwarding?

No. The agent opens and maintains an outbound WebSocket connection to nx.3fe.ru over HTTPS/WSS. The control server never connects to the machine itself. Terminals, SSH relay, web proxy, and worker commands all use this connection. The machine only needs to reach https://nx.3fe.ru.

What can the control plane see in my SSH traffic?

Only ciphertext. SSH connects your client directly to the machine’s sshd, end to end. The control server switches binary frames without interpreting them and has no private SSH keys. Audit records identify who opened a stream, when, and to which machine and port.

Browser terminals are different: their output passes through the control plane in plaintext so it can be displayed and shared with viewers. For particularly sensitive operations, use SSH through a tunnel.

What happens if the network drops?

The agent reconnects automatically, with 1–30 seconds between attempts. tmux and zellij sessions survive on the machine and are reattached; plain shell sessions are lost. Relay streams close, so you must reconnect SSH. Agent tunnels created in the dashboard disappear when the agent restarts. See Terminal and sessions.

What if the control plane is unavailable?

The machine continues working normally; the agent does not mediate local processes. Only new dashboard connections and worker commands become unavailable. Temporary worker sudo grants expire on the machine’s own timer without control plane involvement.

Can I host Nythronix myself?

Yes. The same codebase supports self-hosted mode: run the control server with Docker Compose or systemd, behind your own TLS reverse proxy. Enroll agents the same way, using your server’s URL. See Self-hosted deployment.

Which operating systems are supported?

• Linux x86_64 and aarch64 with systemd: full functionality, including terminals, tmux/zellij, relay, and unprivileged worker execution.
• Windows 10 1809+ / Server 2019+, 64-bit: browser terminal (PowerShell), relay, commands, and automatic updates. No tmux/zellij engines.
• Windows 7 SP1 / 8 / 8.1 / Server 2008 R2 / 2012 / 2012 R2 and any 32-bit Windows: the same functionality except the browser terminal, because ConPTY is unavailable. Machines appear in the dashboard with relay, tunnels, read-only commands, and updates. Open terminals through a neighboring modern machine. The same installer handles all versions.

macOS is not officially supported in the current version.

Who can type in someone else’s terminal?

Everyone in a session sees the same output. Operators with operator, admin, and owner roles can type; viewer can only watch. For consent-code access, the owner controls input permission with --view-only.

Is it safe to share a consent code?

Codes are single-use, expire after a limited time (one hour by default), grant exactly the requested access (a new shell, a specific session, or viewing only), and are invalidated on agent restart. The control server receives only the code’s hash. This is still shell access as the agent user, so share it only with someone you trust and shorten --ttl for brief tasks. Set other people’s machines to Code only so nobody can connect without a code. See Access by consent code.

Which user runs commands?

• Linux operator terminals run as the agent user (root), or as the local login assigned by an administrator in Admin → Operators → Terminal → user. The machine owner can lock the login in /etc/nythronix/agent-policy.json.
• AI worker commands run as the unprivileged nyx-worker if that user exists. Workers receive root only temporarily through Grant root, unless the machine’s local policy prohibits it.
• On Windows, the service and its terminals run as LocalSystem.

Why does the Linux agent service run as root?

The agent is a supervisor with privilege separation: it needs root to switch to nyx-worker or an assigned login, write /etc/sudoers.d/nyx-worker, and replace its binary during updates. Worker commands do not run as root. Use a local policy to restrict the control plane’s abilities; see Linux installation.

How does the agent update?

Automatically when its Update policy in Admin → Agents is auto or auto_idle_only. It downloads the binary, verifies SHA-256 and the Ed25519 signature with the key pinned at enrollment, and restarts. Even a compromised server cannot substitute an unsigned update. With manual (the default), the agent only reports the new version.

How do I uninstall the agent?

Linux: stop and disable the unit, remove the binary, /etc/nythronix, and /etc/sudoers.d/nyx-worker. Windows: Settings → Apps → Nythronix Agent → Uninstall, then optionally remove %ProgramData%\Nythronix. In both cases, delete the machine in Admin → Agents to invalidate its credentials. Step-by-step instructions: Linux, Windows.

How do I quickly block a machine or operator?

For a machine, use Disable in Admin → Agents: it can no longer connect, but its record remains. For an operator, use Disable in Admin → Operators: all dashboard sessions end immediately. Revoke nyx-operator API tokens in Settings → API tokens.

What if a machine never appears Online?

1. Check the service logs: journalctl -u nythronix-agent -f on Linux, %ProgramData%\Nythronix\logs\agent.log.* on Windows.
2. Make sure the token is unused and unexpired; create a new one.
3. Check the URL: wss://nx.3fe.ru/agent/ws or https://nx.3fe.ru.
4. Verify access to https://nx.3fe.ru from the machine, including proxies, firewalls, and TLS inspection.