Nexigon Agent v0.6.0

Higher device-proxy capacity addresses burst-related 502s, and TCP forwarding now requires explicit device port permissions.

Back to Nexigon Agent releases

Release Notes

Higher device-proxy capacity addresses burst-related 502s, and TCP forwarding now requires explicit device port permissions.

Highlights

Together with Hub 2026.3.2, Agent 0.6.0 increases the default device-proxy capacity from 24 to 480 concurrent forwards. This addresses 502 responses caused by the Agent rejecting excess proxy channels during browser bursts. The Hub continues to limit older Agents to 24 forwards.

Agent 0.6.0 also introduces an explicit policy for localhost TCP forwarding, adds optional pairing-key provisioning, and hardens remote terminal credential handling. The release includes a Nix package and NixOS module for the Agent.

Before Upgrading

1. Upgrade the Hub First

Upgrade a Hub to 2026.3.2 before upgrading its Agents to 0.6. The Hub keeps the legacy device HTTP proxy cap for older Agents, then negotiates the higher limit when an upgraded Agent reconnects.

2. Configure TCP Forwarding

Nexigon Agent 0.6 denies TCP forwarding unless the destination port is permitted by the device configuration. An HTTP export permits raw TCP access to its own localhost port. An enabled forwarding policy can permit individual additional ports or all ports.

Before restarting the new Agent, add every required port to the configuration. Existing HTTP exports already permit their declared ports. Enable the additional allowlist for services that are not exports, such as SSH:

[[exports]]
name = "Web UI"
protocol = "http"
port = 80

[forwarding]
enabled = true
allowed-tcp-ports = [22]

Deploy the new binary and configuration together, then restart the Agent. For devices whose required ports cannot be listed in advance, enable all ports:

[forwarding]
enabled = true
allow-all-ports = true

Prefer allowed-tcp-ports when the required ports are known so the device exposes only the intended local services.

Forwarding remains restricted to 127.0.0.1. Destination ports must be individual integers from 1 through 65535. Hub permissions continue to apply.

3. Replace dangerous-disable-tls

The dangerous-disable-tls setting has been removed and is ignored by Agent 0.6.0. Development installations that use it must select the intended behavior explicitly:

# Permit a hub-url using plaintext HTTP/WebSocket.
dangerous-allow-plaintext = true

# Or retain HTTPS while accepting an invalid or self-signed certificate.
dangerous-accept-invalid-certificates = true

These settings are independent. Enable only the behavior required by the development environment; production connections should use validated HTTPS.

Optional Provisioning

An unpaired Agent can accept a one-time pairing value on port 6947 when provisioning is explicitly enabled and no static or provisioned credentials are available.

Assets