Rescue CLI

The rescue CLI is a built-in utility for cases when the panel web interface is unavailable or the usual actions from it do not help. It runs right inside the container, connects to the database and Valkey, and does not depend on a browser, sign-in, or the API.

The CLI is needed if you forgot the administrator password, accidentally disabled password sign-in, want to free up disk space from old records, or lost the SECRET_KEY for a node.

Running

docker exec -it xpanel cli

The XLADA Rescue CLI v0.4 menu appears. Before showing the menu, the utility checks the connection to the database and Valkey: if either is unavailable, it reports an error and exits. That means the container itself needs fixing, not the data.

warning

All commands run bypassing the API and the administrator action log. They write to the database directly, and some of them delete data with no way to roll back. Before a dangerous operation, make a database dump.

What it can do

Command	What it does
Reset superadmin	deletes the super-administrator from the database
Enable password authentication	enables password sign-in
Generate keypairs	creates keys for encrypting response rules
Clean up HWID Devices	clears the hwid_user_devices table
Clean up SRH Table	clears the subscription request history
Clean up Users Usage Table	clears the user traffic history
Delete Users Usage by date range	deletes traffic history for a period
Reset certs	deletes the panel internal certificates
Get SECRET_KEY for a XLADA Node	prints the SECRET_KEY for a node
Exit	exits the utility

Administrator reset

Reset superadmin completely deletes the first administrator account. After that, open the panel in a browser — it will offer to create an administrator from scratch again. The utility asks for confirmation and resets the cached settings so the panel does not remember the old data.

Password sign-in

Enable password authentication comes in handy if you disabled password sign-in in the settings and were left without access. The command returns the switch to the "enabled" position, after which you can sign in with your regular password.

Keys for response rules

Generate keypairs creates a key pair for encrypting routing rule responses. You can choose age1 (X25519) or age1pq1 — a hybrid scheme that is resistant to quantum computing. The public key is inserted into the rule, while the private key is kept by the client and is not sent to the server.

Data cleanup

Three cleanup commands delete data entirely, each with its own confirmation:

• Clean up HWID Devices — all user devices;
• Clean up SRH Table — the subscription request history;
• Clean up Users Usage Table — the traffic history, and rebuilds the indexes.

Delete Users Usage by date range deletes traffic history only for the period you need. Dates are entered strictly in the DD-MM-YYYY format, for example 01-01-2026. You can choose a single query (faster, but it holds the lock longer) or a batch mode with a progress indicator. At the end, VACUUM runs, so you must not close the window — an interruption will leave the table bloated.

# save a dump before cleanup
docker exec xpanel-db pg_dump -U xpanel xpanel > backup-$(date +%F).sql

Certificates and nodes

Reset certs deletes the internal certificates. After that, the SECRET_KEY on all nodes stops working, and they will have to be connected again. After the command, restart the panel:

docker compose down && docker compose up -d

Get SECRET_KEY for a XLADA Node prints the SECRET_KEY for connecting a new node — it helps when you cannot get it in the panel.

danger

Reset certs breaks the connection to all nodes at once. Do not run it unless you are ready to issue keys to every server again.

Node CLI

A node has its own CLI with a separate set of commands:

docker exec -it xpanel-node cli

It can dump the current Xray configuration, kill connections by IP, and clear the Xray logs. The commands are also available without the menu:

docker exec -it xpanel-node cli --dump-config       # configuration with highlighting
docker exec -it xpanel-node cli --dump-config-raw   # machine-readable output
docker exec -it xpanel-node cli --kill-sockets      # kill connections by IP
docker exec -it xpanel-node cli --clear-logs        # clear the Xray logs
docker exec -it xpanel-node cli --help              # help

Log cleanup rotates the files, Xray is not restarted and traffic is not interrupted.

tip

The --dump-config-raw output is convenient to redirect to a file for comparing configuration versions:

docker exec -i xpanel-node cli --dump-config-raw > xray-config.json

What's next

• Common Errors — a breakdown of typical panel failures.
• Useful Commands — everyday work with containers.
• Upgrading — how to update the panel and nodes.
• Panel Security — access protection.