---
title: "nodeaD agent"
description: "nodeaD connects servers to the Nodea panel: telemetry, tasks without SSH, an nftables firewall with automatic rollback and an encrypted mTLS connection."
url: "https://nodea.io/en/nodead"
lang: "en"
updated: "2026-11-12"
---

# nodeaD agent

## nodeaD — the agent that connects your servers to the panel

A lightweight program on your server that collects telemetry, runs tasks ordered in the panel and keeps the firewall in check. No SSH logins and no scripts on every machine.

- [Go to servers in the panel](https://app.nodea.io/app/compute)
- [Let's talk](https://nodea.io/en/kontakt?usluga=nodead)

## What nodeaD does

### Telemetry

CPU, memory, disks and network feed the charts and alerts in the panel.

### Tasks from the panel

Operations ordered in the panel are run by the agent on the server — the panel never logs in over SSH.

### Firewall with confirmation

You edit nftables rules in the panel. A change that cuts off access rolls itself back.

### Self-updates

The agent updates itself from the stable or the test channel chosen for the server.

### Encrypted connection

The agent connects to the panel over mTLS, with a certificate issued only for that server.

### Web traffic protection

The same program in proxy mode filters web traffic: a WAF and DDoS protection.

*Firewall*

## Server rules in the panel, not in a terminal

You set the default policy for incoming, forwarded and outgoing traffic and add rules and address sets. The agent applies them on the server and reports the actual state back, so the panel shows what really runs.

- revision history showing who changed the rules and when,
- automatic rollback of a change that is not confirmed,
- a warning when someone changes the rules directly on the server.

![Nodea panel — server firewall managed by the nodeaD agent: default policy and rules (demo data)](https://nodea.pl/storage/cms/1/2026/11/panel-firewall-en.png)

## For administrators

- **Outbound connection** — the agent connects to the panel control plane over mTLS (port 9443) on its own. No ports need to be opened on the server for the panel.
- **Joining a server** — the panel prepares a one-time bootstrap package with a CA certificate and a short-lived token.
- **systemd service** — the agent runs as a system service on Linux with systemd.
- **Proxmox nodes** — on our nodes the agent also handles ZFS encryption with keys in a vault and GPU passthrough to virtual machines.

## Frequently asked questions

### Does the panel log in to my server over SSH?

No. Tasks are run by the agent on the server, which connects to the panel on its own over an encrypted mTLS connection.

### What happens if a firewall change locks me out?

Every change must be confirmed. If you do not confirm it in time — because you lost the connection, for example — the agent restores the previous rules.

### Which systems does nodeaD run on?

On Linux servers with systemd. Our virtual machine templates come with the agent installed.

## Connect your servers to the panel

We will advise how to enable the agent on existing servers and on machines from our templates.

[Contact us](https://nodea.io/en/kontakt?usluga=nodead)

---

Languages: [pl](https://nodea.pl/pl/nodead.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)