Skip to content

Features

Everything CompassVPN does, in one place. You do not need to understand every item on this page to run your own VPN; the defaults are sensible, and every setting mentioned below is explained in the Configuration guide when you want to change something.

Easy Setup

Go from a fresh server to a working VPN in minutes.

  • One file, one command: Clone the repository, edit one settings file (env_file), and run ./agent.sh start.
  • Safe to re-run: The setup command (an idempotent Ansible playbook) can be run again at any time, after changing settings or just to make sure everything is in order, without breaking anything.
  • Certificates handled for you: SSL certificates are created and renewed automatically (via ZeroSSL or Let’s Encrypt).
  • DNS handled for you: The required Cloudflare DNS records are created and managed automatically.
  • Direct or through Cloudflare: Choose connection types that go straight to your server, ones that route through Cloudflare’s network, or a mix of both.

Secure by Default

Sensible protection out of the box, with nothing extra to configure.

  • Automatic blocking: Torrents, ads, malware, and phishing sites are filtered using curated blocklists that update daily.
  • Tested before live: Every new configuration is verified (with Xray-Knife) before it is applied.
  • Locked-down services: Each service runs in a hardened container with the minimum permissions it needs.
  • Firewall set up for you: The server firewall (UFW) is configured automatically, opening only the required ports.
  • A decoy for snoopers: To anyone who is not a real client, your server looks like an ordinary website (served by NGINX).

Live Dashboard

See what your VPN is doing at a glance, from anywhere.

  • Ready-made dashboard: Your server reports to Grafana Cloud (free tier is enough) or your own Prometheus setup; see the Monitoring guide.
  • Live connection stats: Active connections and traffic per connection type, with optional per-user traffic breakdowns.
  • Server health: CPU, memory, and network usage of the server itself.
  • Usage insight: An estimate of unique active users, plus a count of blocked junk traffic so you can see what the filters saved you.

Grows With You

Start with one small server and add more whenever you need.

  • Repeatable setup: The same short setup works on every new server; add capacity by simply repeating it.
  • One dashboard for everything: Metrics from any number of servers flow into a single dashboard.
  • Load-balancer friendly: Servers hold no shared state, so they work behind standard load balancers for high availability.

Smart Networking

Tune how traffic flows without touching low-level settings.

  • Choose your DNS: Use the default, a filtering provider (Cloudflare Security, ControlD), or any custom resolver (DoH, DoQ, DoT, or plain UDP) via CUSTOM_DNS .
  • Choose your route out: Send traffic out directly or through a Cloudflare WARP tunnel via XRAY_OUTBOUND . With WARP enabled, each connection type gets its own dedicated tunnel.
  • Bandwidth insight: Watch how much unwanted traffic was blocked and estimate the bandwidth saved.

Censorship Resistance

Built to stay reachable on heavily filtered networks, with modern connection technology underneath.

  • Several connection types: Enable any mix of VLESS connections (over TCP, HTTPUpgrade, XHTTP, and QUIC) via XRAY_INBOUNDS , so if one type is blocked, another usually still works.
  • Cloudflare routing: -cdn connection types hide your server behind Cloudflare’s network, so censors cannot see or block its real address.
  • Traffic disguise: REALITY connection types make VPN traffic look like a normal visit to a real website, without needing a certificate.
  • Future-proof encryption: Post-quantum VLESS Encryption (ML-KEM-768 + X25519) on non-TLS HTTPUpgrade connections.
  • Replicas: Scale any HTTP-path connection type into multiple instances with the name:count syntax (e.g. vless-hu-tls-cdn:3).

Hands-Off Maintenance

The server looks after itself so you do not have to.

  • Watchdog: A supervisor (Monit) restarts any service that crashes or stops responding, with limits so a truly broken service surfaces as a problem instead of looping.
  • Automatic rotation: Set REDEPLOY_INTERVAL to periodically regenerate connection settings for extra safety.
  • Optional auto-updates: Enable AUTO_UPDATE to check for and apply updates hourly (off by default).

Ready to try it? The Quick Start guide takes about fifteen minutes.