Nexigon Agent v0.6.0

Higher device-proxy capacity addresses burst-related 502s, and TCP forwarding now requires explicit device port permissions.

Back to Nexigon Agent releases

Release Notes

Higher device-proxy capacity addresses burst-related 502s, and TCP forwarding now requires explicit device port permissions.

Highlights

Together with Nexigon Hub 2026.3.2, Nexigon Agent 0.6.0 increases the default device-proxy capacity from 24 to 480 concurrent forwards. This addresses 502 responses caused by the Nexigon Agent rejecting excess proxy channels during browser bursts. The Nexigon Hub continues to limit older Nexigon Agent instances to 24 forwards.

Nexigon Agent 0.6.0 also introduces an explicit policy for localhost TCP forwarding, adds optional pairing-key provisioning, and hardens remote terminal credential handling. The release includes a Nix package and NixOS module for the Nexigon Agent.

Before Upgrading

1. Upgrade Nexigon Hub for Higher Capacity

For a self-hosted instance, upgrade Nexigon Hub to 2026.3.2 or later before upgrading devices to use the higher capacity. Older Nexigon Hub versions remain compatible but do not use the new capacity metadata. Nexigon Cloud users do not manage the Nexigon Hub upgrade.

Nexigon Hub keeps the legacy proxy cap for older agents and negotiates the higher limit when an upgraded device reconnects.

2. Configure TCP Forwarding

Nexigon Agent 0.6 denies TCP forwarding unless the destination port is permitted by the device configuration. An HTTP export permits raw TCP access to its own localhost port. An enabled forwarding policy can permit individual additional ports or all ports.

Before restarting the new Nexigon Agent, add every required port to the configuration. Existing HTTP exports already permit their declared ports. Enable the additional allowlist for services that are not exports, such as SSH:

[[exports]]
name = "Web UI"
protocol = "http"
port = 80

[forwarding]
enabled = true
allowed-tcp-ports = [22]

Deploy the new binary and configuration together, then restart the Nexigon Agent. For devices whose required ports cannot be listed in advance, enable all ports:

[forwarding]
enabled = true
allow-all-ports = true

Prefer allowed-tcp-ports when the required ports are known so the device exposes only the intended local services.

Forwarding remains restricted to 127.0.0.1. Destination ports must be individual integers from 1 through 65535. Nexigon Hub permissions continue to apply.

3. Replace dangerous-disable-tls

The dangerous-disable-tls setting has been removed and is ignored by Nexigon Agent 0.6.0. Development installations that use it must select the intended behavior explicitly:

# Permit a hub-url using plaintext HTTP/WebSocket.
dangerous-allow-plaintext = true

# Or retain HTTPS while accepting an invalid or self-signed certificate.
dangerous-accept-invalid-certificates = true

These settings are independent. Enable only the behavior required by the development environment; production connections should use validated HTTPS.

Optional Provisioning

An unpaired Nexigon Agent can accept a one-time pairing value on port 6947 when provisioning is explicitly enabled and no static or provisioned credentials are available. Follow Device Provisioning for setup and production handoff.

Assets