XyNginC (Nginx Controller & Service Supervisor)
XyNginC (XyPriss Nginx Controller) is an official plugin and system CLI (xynginc / xncp) that automates Nginx reverse proxying, Let's Encrypt SSL provision, and production systemd process supervision.
Reverse Proxy
Automated domain-to-port mapping with zero manual Nginx editing.
Automated SSL
Native Let's Encrypt and ACME Certbot integration for automatic HTTPS.
Go-Powered CLI
High-speed native binary for low-latency system-level operations.
Systemd Supervisor
Zero-config process supervision, auto-restart, and resource limits.
Installation
Install the plugin into your project workspace using XFPM:
xfpm install xyngincRegisters CLI aliases xynginc and xncp in your workspace environment.
Server Integration
Register XyNginC within your server initialization pipeline:
import { createServer } from "xypriss";
import XNCP from "xynginc";
const app = createServer({
plugins: {
register: [
XNCP({
domains: [
{
domain: "api.example.com",
port: 8088,
ssl: true,
email: "ops@example.com",
maxBodySize: "25M",
},
{
domain: "auth.example.com",
port: 8089,
ssl: true,
email: "ops@example.com",
},
],
installRequirements: true,
autoReload: true,
autoFixFirewall: true,
sudoPassword: process.env.SUDO_PASSWORD,
}),
],
},
});
app.start();Process Supervision & Service Management
XyNginC includes dedicated systemd management commands to ensure persistent execution, crash resilience, and automatic startup upon system boot.
Service Provisioning & Deployment
Deploy your application as a managed systemd background service from your project root:
sudo xfpmx xncp service deploy # Alias: sudo xfpmx xncp deployAutomated Systemd Provisioning Steps
- •Runtime Detection: Auto-detects runtime binary (
bun v1.2+ornode v18+). - •Entrypoint Discovery: Finds project bootstrap file (
src/server.ts,server.ts, ordist/index.js). - •Environment Binding: Auto-discovers and binds local
.envconfiguration file. - •Non-Root Execution: Runs under non-root system owner (
SUDO_USER). - •Resource Hardening: Enforces file and process limits (
LimitNOFILE=65535,LimitNPROC=4096). - •Auto-Restart Policies: Configures instant recovery (
Restart=always,RestartSec=5s).
Service Operation Commands
# List all managed services
xfpmx xncp service list # Alias: xfpmx xncp services
# Inspect service status & Nginx health
xfpmx xncp service status [service-name]
# Follow live application log output
xfpmx xncp logs -f
# Start, stop, or restart service
sudo xfpmx xncp service start [service-name]
sudo xfpmx xncp service stop [service-name]
sudo xfpmx xncp service restart [service-name]
# Uninstall systemd service unit
sudo xfpmx xncp service uninstall [service-name]CLI Reference
The CLI can be invoked globally as xynginc / xncp or locally via xfpmx xncp:
| Command Category | Command | Description |
|---|---|---|
| Diagnostics | sudo xynginc check / install | Verify system dependencies and auto-provision missing tools. |
| Supervision | sudo xynginc deploy [name] | Provision and launch systemd service for current project workspace. |
| Virtual Hosts | sudo xynginc add / remove / list | Dynamically add, remove, or list active Nginx reverse proxy virtual hosts. |
| Maintenance | sudo xynginc test / reload / clean | Validate Nginx syntax, trigger safe reload, or purge broken virtual hosts. |
| Backups | sudo xynginc restore <backup_id> | Revert to a previous Nginx configuration backup snapshot. |
TypeScript Options Reference
XyNginCDomainConfig
interface XyNginCDomainConfig {
domain: string; // Target host (e.g., "api.example.com")
port: number; // Local listener port (e.g., 8088)
ssl?: boolean; // Enable Let's Encrypt TLS (default: false)
email?: string; // ACME registration email
maxBodySize?: string; // Client request limit (e.g., "25M", default: "10M")
}XyNginCPluginOptions
interface XyNginCPluginOptions {
domains: XyNginCDomainConfig[];
installRequirements?: boolean; // Provision system dependencies if missing (default: false)
autoReload?: boolean; // Reload Nginx upon successful configuration (default: true)
autoFixFirewall?: boolean; // Provision UFW rules for ports 80/443 (default: false)
sudoPassword?: string; // Password for non-interactive privilege escalation
binaryPath?: string; // Custom path to xynginc Go binary
autoDownload?: boolean; // Retrieve binary if not present (default: true)
version?: string; // Specific Go core release tag (default: "latest")
}Programmatic Server API (server.xynginc)
When registered, XyNginC attaches management methods directly to server.xynginc:
// Dynamically register a domain at runtime
await server.xynginc.addDomain("api.example.com", 8088, true, "ops@example.com", "25M");
// Unregister a domain and remove virtual host
await server.xynginc.removeDomain("api.example.com");
// Query configured domain inventory
const domains: string[] = await server.xynginc.listDomains();
// Execute Nginx configuration syntax test
const isValid: boolean = await server.xynginc.test();
// Trigger safe service reload
await server.xynginc.reload();
// Retrieve aggregate infrastructure status
const summary: string = await server.xynginc.status();Security & Compliance Specifications
Privilege Separation
Application services execute strictly under unprivileged user accounts (SUDO_USER). Sudo escalation is scoped exclusively to config files and service reloads.
Transient Config Cleanup
Configurations pass to the Go core via transient, restricted-permission files (/tmp/.xynginc-config-*.json) that are deleted immediately after parsing.
Signature Integrity
Distributed with an official cryptographic manifest (xypriss.plugin.xsig) validated by the XyPriss runtime against tampering.
Loopback Network Isolation
Nginx reverse proxy templates restrict upstream listeners to loopback interfaces (127.0.0.1) by default, blocking direct public access.
Learn how to properly set up XyNginC and system requirements on your production Linux server.