Launch Sale · Save 41%
The All-in-One Linux Server
Management Agent
Web hosting, databases, reverse proxy, WAF, private DNS, cluster sync, anti-tamper, virtualization
— one agent does it all. Manage many nodes from a single panel, ditch the SSH-by-SSH grind.
— one agent does it all. Manage many nodes from a single panel, ditch the SSH-by-SSH grind.
glibc 2.17+ · runs on every modern distro
10K+
Nodes managed
300+
Companies
99.99%
Uptime
24/7
Support
Core Capabilities
One agent, every layer. From hosting sites to running clusters, from code to DNS — full stack covered.
Web Hosting
Nginx / Apache / HAProxy one-click sites, domain binding, free SSL certs, runs PHP / Node / Python / Java.
Databases
MySQL / PostgreSQL / MongoDB / Redis / Memcached multi-instance with user isolation. Master-slave in one click.
WAF / Anti-tamper
ModSecurity OWASP CRS + JA3 / JA4 fingerprint blocking + eBPF LSM file protection. Defense in depth.
Cluster Sync / CDN
Sync groups + Microservice reverse proxy = self-built CDN. Push IP / GeoIP / JA3 rules to every node.
DB Replication
MySQL / PG / Mongo master-slave, auto GTID check, resumable seed, MASTER_SSL end-to-end encryption.
Virtualization
KVM / Docker / dockur wrapper, ISO pool, remote noVNC console — run Windows / Linux guests.
Analytics / Monitoring
PV / UV / Referrer stats, website self-heal, log aggregation, heartbeat alerts via SMTP / webhook.
One-Click Multi-Node
SSH-deploy NK to any Linux sub-node. First boot auto-joins the master for unified management.
AI Assistant
Built-in Claude / GPT / MiniMax. One line: build sites, install WordPress, configure WAF. Safe ops auto-run, risky ones prompt for approval.
Cross-site Mesh
In-house encrypted underlay + BGP EVPN + VXLAN — sites across data centres behave like one switch. Zero config on terminals; IPv6 / dual-stack, egress selection, link compression.
Product Screenshots
Click any image to see the real admin UI.
From dashboard to replication — every module in one unified dark panel.
Dashboard Overview
Reverse Proxy / LB
MySQL Multi-Instance
DB Replication
Nginx Management
IP / CIDR Rules
Users & Permissions
System Settings / SMTP
5 Plans · Per-Node Pricing
Free tier is forever free. Paid plans price per node, unlimited sites & instances.
Annual billing saves 17%. Launch promo saves another 41% (over 50% off combined).
FREE
$0
Forever free · 1 node
1 node · unlimited websites
Nginx / Apache / HAProxy
MySQL / PG / Mongo
Basic WAF + backups
Heartbeat alerts / multi-node mgmt
Logs / monitoring / analytics
JA3 / JA4 protection
PERSONAL
Launch -41%
$30/yr/node (save 17% more)
Everything in Free +
Logs / website logs
Monitoring with self-heal
Website analytics
Microservice reverse proxy
JA3 / JA4 advanced WAF
Multi-user / virtualization
TEAM RECOMMENDED
Launch -41%
$70/yr/node (save 17% more)
Everything in Personal +
Multi-user with permissions
KVM / Docker virtualization
Automated backup policies
10 users/node
Sync groups (CDN)
DB replication
BUSINESS
Launch -41%
$290/yr/node (save 17% more)
Everything in Team +
Sync groups (self-built CDN)
DB replication management
PDNS private DNS
Unlimited users/node
Self-managed ZeroSSL key
CUSTOM
Contact
Private deployment · custom dev
Everything in Business +
Self-managed ZeroSSL key
Open API (WHMCS integration)
Custom feature development
Dedicated technical support
Unlimited nodes / users
Full Feature Comparison
Side-by-side capabilities per plan → see detailed features
| Feature | Free | Personal | Team | Business | Custom |
|---|---|---|---|---|---|
| Quotas | |||||
| Nodes per license | 1 | 1 | 1 | 1 | 1 |
| Max nodes per account | 1 | unlimited | unlimited | unlimited | unlimited |
| Users per node | 1 | 1 | 10 | unlimited | unlimited |
| Websites | unlimited | unlimited | unlimited | unlimited | unlimited |
| Database instances | unlimited | unlimited | unlimited | unlimited | unlimited |
| Hosting / Reverse Proxy / App Runtimes | |||||
| Nginx site management | ✓ | ✓ | ✓ | ✓ | ✓ |
| Apache multi-version (httpd 2.2 / 2.4) | ✓ | ✓ | ✓ | ✓ | ✓ |
| PHP multi-version + FPM pool | ✓ | ✓ | ✓ | ✓ | ✓ |
| Java / Python / Node.js runtimes | ✓ | ✓ | ✓ | ✓ | ✓ |
| Nginx reverse proxy | ✓ | ✓ | ✓ | ✓ | ✓ |
| HAProxy load balancing | ✓ | ✓ | ✓ | ✓ | ✓ |
| Backend health check | ✓ | ✓ | ✓ | ✓ | ✓ |
| File manager (whole system) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Scheduled tasks / systemd units | ✓ | ✓ | ✓ | ✓ | ✓ |
| Rclone file sync | ✓ | ✓ | ✓ | ✓ | ✓ |
| Supervisor process control | ✓ | ✓ | ✓ | ✓ | ✓ |
| Per-user isolation (dedicated system accounts) | ✓ | ✓ | ✓ | ✓ | ✓ |
| DD re-install (in-place whole-machine OS swap, no virtualization / IPMI needed) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Hosting operations (quota / traffic / WHMCS) | ✕ | ✕ | ✕ | ✓ | ✓ |
| Databases / Cache | |||||
| MySQL / MariaDB multi-instance | ✓ | ✓ | ✓ | ✓ | ✓ |
| PostgreSQL multi-instance | ✓ | ✓ | ✓ | ✓ | ✓ |
| MongoDB multi-instance | ✓ | ✓ | ✓ | ✓ | ✓ |
| Redis multi-instance | ✓ | ✓ | ✓ | ✓ | ✓ |
| Memcached multi-instance | ✓ | ✓ | ✓ | ✓ | ✓ |
| FTP multi-instance | ✓ | ✓ | ✓ | ✓ | ✓ |
| XtraBackup physical backup | ✓ | ✓ | ✓ | ✓ | ✓ |
| DB replication (MySQL / PG / Mongo) | ✕ | ✕ | ✕ | ✓ | ✓ |
| SSL Certificates | |||||
| Domain certs: auto issue + auto renew | ✓ | ✓ | ✓ | ✓ | ✓ |
| Wildcard certificates | ✓ | ✓ | ✓ | ✓ | ✓ |
| IP certificates | ✓ | ✓ | ✓ | ✓ | ✓ |
| Multiple validations (email / DNS / file) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Pre / post issue hooks (any DNS provider) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Push certificates to child nodes | ✓ | ✓ | ✓ | ✓ | ✓ |
| Self-managed ZeroSSL key + cert API | ✕ | ✕ | ✕ | ✕ | ✓ |
| Security | |||||
| System firewall (nftables inbound) | ✓ | ✓ | ✓ | ✓ | ✓ |
| WAF (ModSecurity + OWASP CRS) | ✓ | ✓ | ✓ | ✓ | ✓ |
| SSH 2FA (Google Authenticator / YubiKey) | ✓ | ✓ | ✓ | ✓ | ✓ |
| SSH key login / system user management | ✓ | ✓ | ✓ | ✓ | ✓ |
| Panel 2FA + step-up verification | ✓ | ✓ | ✓ | ✓ | ✓ |
| Kernel tuning (sysctl) / swap | ✓ | ✓ | ✓ | ✓ | ✓ |
| Port forwarding (SSH / iptables / FRP) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Tamper protection (kernel-level, per file / dir / UID) | ✕ | ✕ | ✓ | ✓ | ✓ |
| JA3 / JA4 TLS fingerprint blocklist | ✕ | ✓ | ✓ | ✓ | ✓ |
| Cross-site Mesh | |||||
| Encrypted underlay (in-house Noise IK) + BGP EVPN + VXLAN | ✕ | ✓ | ✓ | ✓ | ✓ |
| Layer-2 across sites (zero terminal config) | ✕ | ✓ | ✓ | ✓ | ✓ |
| IPv6 / dual-stack + cross-family relay | ✕ | ✓ | ✓ | ✓ | ✓ |
| Egress selection (exit via a chosen site) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Link compression + dictionary self-learning | ✕ | ✓ | ✓ | ✓ | ✓ |
| Branch edge router (RouterOS CHR) onboarding *2 | ✕ | ✓ | ✓ | ✓ | ✓ |
| Mesh topology view + layered diagnostics | ✕ | ✓ | ✓ | ✓ | ✓ |
| Virtualization / VPS | |||||
| Docker (KVM virtualization) | ✕ | ✕ | ✓ | ✓ | ✓ |
| ESXi virtualization *3 | ✕ | ✕ | ✓ | ✓ | ✓ |
| One-click provisioning / re-install (iPXE) *4 | ✕ | ✕ | ✓ | ✓ | ✓ |
| Web console | ✕ | ✕ | ✓ | ✓ | ✓ |
| Auto IP allocation / IP binding isolation | ✕ | ✕ | ✓ | ✓ | ✓ |
| Snapshots + scheduled snapshots | ✕ | ✕ | ✓ | ✓ | ✓ |
| Off-site DR + scheduled DR | ✕ | ✕ | ✓ | ✓ | ✓ |
| Rescue system (ESXi) *3 | ✕ | ✕ | ✓ | ✓ | ✓ |
| VM monthly traffic cap / port mapping | ✕ | ✕ | ✓ | ✓ | ✓ |
| Content Delivery (CDN) | |||||
| CDN sites (in-house Rust edge) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Cache rules / stale-while-error (always online) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Multi-backend + fallback + health monitor | ✕ | ✓ | ✓ | ✓ | ✓ |
| Request / response header rewrite, content replace, redirect | ✕ | ✓ | ✓ | ✓ | ✓ |
| IP / CIDR rule sets (allow / deny) | ✕ | ✓ | ✓ | ✓ | ✓ |
| GeoIP rules (country / city / ASN / ISP / connection type) *1 | ✕ | ✓ | ✓ | ✓ | ✓ |
| Rate limiting (global / site / URL) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Human verification (PoW / captcha / JS challenge) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Escalate matched rules to the system firewall | ✕ | ✓ | ✓ | ✓ | ✓ |
| High-perf origin fetch (browser fingerprint + HTTP/3 + proxy) | ✕ | ✕ | ✕ | ✓ | ✓ |
| CDN plans / traffic packages for resale | ✕ | ✕ | ✕ | ✓ | ✓ |
| Domains / DNS | |||||
| Domain list / expiry reminders / whois | ✕ | ✕ | ✕ | ✓ | ✓ |
| All record types (A / AAAA / TXT / wildcard…) | ✕ | ✕ | ✕ | ✓ | ✓ |
| Per-record CDN toggle | ✕ | ✓ | ✓ | ✓ | ✓ |
| GeoDNS (continent / country / region / ISP) | ✕ | ✕ | ✕ | ✓ | ✓ |
| Split by rDNS / search engine / connection type | ✕ | ✕ | ✕ | ✓ | ✓ |
| TTL down to 60s · push zones to child nodes | ✕ | ✕ | ✕ | ✓ | ✓ |
| In-house mail server (standalone binary, not Postfix/Dovecot) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Mail domains / users / quotas | ✓ | ✓ | ✓ | ✓ | ✓ |
| Aliases and forwarding (multi-target fan-out) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Catch-all (per domain + global) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Webmail + TLS/SSL | ✓ | ✓ | ✓ | ✓ | ✓ |
| Semantic mail search (vector retrieval) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Monitoring / Analytics / Logs | |||||
| Dashboard (CPU / RAM / disk / network realtime) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Connectivity test | ✓ | ✓ | ✓ | ✓ | ✓ |
| Node heartbeat alerts (email / webhook) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Website monitor (IP / domain / SSL expiry / status / SLA) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Alert channels (email / WeCom / DingTalk / Lark / SMS) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Self-heal actions (restart service / run script) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Web analytics (PV/UV/IP/sessions/heatmap/funnel/replay) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Site logs (cache hit / JA3 / region / upstream) | ✕ | ✓ | ✓ | ✓ | ✓ |
| WAF defense logs | ✕ | ✓ | ✓ | ✓ | ✓ |
| Multi-node / Collaboration | |||||
| Node list + batch command execution | ✓ | ✓ | ✓ | ✓ | ✓ |
| Web terminal (local and remote nodes) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Node resource monitoring (CPU / RAM / disk / net) | ✓ | ✓ | ✓ | ✓ | ✓ |
| One-click deploy NK to a new node via SSH | ✓ | ✓ | ✓ | ✓ | ✓ |
| Multi-user + user-group permissions | ✕ | ✕ | ✓ | ✓ | ✓ |
| Per-user / per-group quotas (disk / sites / instances / mail) | ✕ | ✕ | ✓ | ✓ | ✓ |
| Sync groups (rules / CDN sites / forwarding) | ✕ | ✕ | ✕ | ✓ | ✓ |
| Private DNS engine (PowerDNS) | ✕ | ✕ | ✕ | ✓ | ✓ |
| Backups | |||||
| Manual backup (rclone + xtrabackup) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Scheduled backup (sites / databases / VMs) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Multi-target remotes (S3 / FTP / SFTP / Google Drive / OneDrive / WebDAV) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Backup quota (sold by capacity) | ✕ | ✕ | ✕ | ✓ | ✓ |
| AI Assistant | |||||
| AI troubleshooting chat (can act on the system) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Multiple model providers | ✕ | ✓ | ✓ | ✓ | ✓ |
| On the Roadmap | |||||
| Kubernetes cluster integration | in dev | in dev | in dev | in dev | in dev |
| Ceph distributed storage | in dev | in dev | in dev | in dev | in dev |
| MinIO object storage | in dev | in dev | in dev | in dev | in dev |
| App 1-click install (WordPress / Joomla …) | in dev | in dev | in dev | in dev | in dev |
| Support | |||||
| Official technical support | None | 5/mo | 10/mo | 100/mo | Per contract |
| Community Q&A | ✓ | ✓ | ✓ | ✓ | ✓ |
| Ticket support | ✕ | ✓ | ✓ | ✓ | ✓ |
| Email support | ✕ | ✕ | ✓ | ✓ | ✓ |
| Phone support | ✕ | ✕ | ✕ | ✓ | ✓ |
| Response priority | None | Medium | High | Top | Dedicated contact |
| Response time | — | 5×6 (09:00-16:00) | 5×8 (09:00-18:00) | 7×24 | 7×24 + SLA |
| Commerce Backoffice (Custom only) | |||||
| Billing (orders / payments / plans) | ✕ | ✕ | ✕ | ✕ | ✓ |
| Open API (WHMCS / your own finance / CRM) | ✕ | ✕ | ✕ | ✕ | ✓ |
| Ticket system | ✕ | ✕ | ✕ | ✕ | ✓ |
| Third-party software / licences | |||||
| *1 Commercial GeoIP database (MaxMind GeoIP2) — Country / city / ASN work out of the box with the free GeoLite2 database, which NodeKeeper downloads and refreshes monthly — no extra purchase needed. However ISP, domain and connection type (residential / hosting / mobile) exist only in MaxMind's commercial GeoIP2 database. Without it, rules built on those three fields simply never match; everything else is unaffected. Subscribe directly from MaxMind, or let us purchase it for you at $500 per order. | |||||
| *2 RouterOS CHR licence (MikroTik) — This licence is not included. You can still use the feature without it — MikroTik's free tier is functionally complete (management, routing, DHCP, firewall); the only limit is 1 Mbps per interface, which is fine for validation and small sites but not for production bandwidth. For more throughput buy a perpetual licence from MikroTik (P1 / P10 / PU, tiered by per-interface bandwidth); refer to mikrotik.com for the current tiers and pricing. A licence binds to a single instance and cannot be shared. | |||||
| *3 VMware ESXi licence (Broadcom) — NodeKeeper manages an ESXi host you already own; it neither resells nor includes the ESXi licence itself — obtain that directly from Broadcom / VMware (the free-tier policy has changed repeatedly in recent years; their current announcement governs). You do not need ESXi to run virtual machines: the built-in Docker (KVM) path covers power control, console, snapshots, traffic caps and port mapping. Only the ESXi-specific items marked *3 (ESXi onboarding, ESXi rescue system) require an ESXi host of your own. | |||||
| *4 Windows licence (Microsoft) — Provisioning Linux needs no extra licence at all. When installing Windows, the Windows licence is yours to provide — we neither supply nor resell it. It installs, boots and works unactivated; you simply get the persistent "Activate Windows" watermark, personalisation (wallpaper / themes) stays locked, and Microsoft may restrict some updates. Put your own key in the unattend file at provisioning time and it activates automatically. | |||||
5 Steps to Get Started
From download to your first node online in 5 minutes.
1
Download NK
Single static musl binary, no dependencies.
2
Run It
./nodekeeper, init admin account.
3
Add Nodes
One-click SSH deploy NK to any Linux box.
4
Choose Plan
Pick plan + node count, pay via Stripe.
5
Go Live
Host sites, configure SSL, run workloads — all via UI.
Trusted by Teams Like Yours
Companies from Internet / Gaming / E-commerce / SaaS / AI run NodeKeeper in production.
Customer Logo
Customer Logo
Customer Logo
Customer Logo
Customer Logo
Customer Logo
FAQ
Still have questions? Talk to sales
Written in Rust, ships as a single binary, has a built-in Microservice reverse proxy with JA3 / JA4 fingerprint protection, and natively supports multi-node cluster rule push. Per-node licensing, no account lock-in.
Yes. Free includes hosting, databases, reverse proxy, and basic WAF — enough for personal projects and small workloads. Differentiation is in logs, monitoring, JA3 / JA4, clustering, virtualization, and replication.
Per-node — every install needs its own license at the plan price, bound to the machine or IP. Annual billing saves 17%. Launch promo saves another 41%. No node count cap.
IP-bound licenses can be re-bound from the admin panel. Machine-bound licenses are sticky (anti-abuse). You pick the binding type at issuance time.
Yes. Every install (master or sub) needs its own license, and master + sub must be on the same plan tier (no cross-tier mixing).
Anything with glibc 2.17+ — CentOS 7+, RHEL 7+, Debian 9+, Ubuntu 16.04+, plus Anolis, Kylin V10, UOS. x86_64 and aarch64.
Admin panel → My Orders → Upgrade. We compute the prorated difference and your license codes refresh to the new tier immediately.
Yes — request from My Orders. Electronic invoices for Chinese customers, PDF receipts for international. VAT invoices on request.
Start Managing Your Servers Today
Free tier is forever free, no credit card required.
Download Free See Paid Plans7-Day Refund
Full refund within 7 days if license not extracted.
24-Hour Response
Paid customer tickets answered within 24h.
Data Security
AES-256-GCM encryption, keys never leave your node.
Invoices
Electronic invoices / PDF receipts on request.