A proxy panel built around the Cloudflare edge
Nova Proxy packages a personal proxy service, admin panel, and subscription system into one Cloudflare Worker. The practical appeal is immediate: there is no origin server to patch just to get started. A deployment creates the Worker plus KV and D1 storage in the user's own Cloudflare account. The panel then creates individual accounts with quotas, expiry dates, daily limits, and private links that standard clients can import.
The connection menu is broad. Nova publishes VLESS, Trojan, Shadowsocks, gRPC, XHTTP, WARP, WireGuard, and AmneziaWG options through Auto, Base64, Clash, and sing-box friendly outputs. Its Resistance Policy exposes routing choices intended for Iran and other filtered networks. Nova Radar scans Cloudflare IPs from the browser, and a mixed subscription can carry VLESS and Trojan together. Workers and Pages can provide two front doors backed by the same data, which is a useful response when either public domain is filtered.
This is more coherent than handing relatives a folder of configuration files. The admin can change one account, and the user's subscription reflects it. Telegram management, node-name templates, GitHub mirror links, ad blocking, and per-user settings fill out a panel designed for ongoing use rather than a one-time connection test. The default README is in English, with Persian documentation and a panel that also offers Russian.
Setup is short, but ownership still has chores
The recommended Deploy to Cloudflare button creates a user-owned GitHub repository, provisions storage, and connects Workers Builds. That is a genuinely friendly route for software with this many moving parts. Nova says the flow does not ask users to create or paste a Cloudflare API token. A Telegram installer offers a phone-only route. Developers can instead install Wrangler, authenticate, run npm ci, and deploy.
After deployment, the operator must open the admin path and establish ownership. Release 4.7.0 removed the first-run claim-token gate for manual installs, so whoever sets the password first owns a fresh panel. The installer bot claims it during deployment, but manual users should not leave the new address unattended. Backups, restore, health checks, and Cloudflare rollback support make later operation more manageable.
Updates are unusually reviewable for a guided deployment. A scheduled GitHub Action can open a pull request containing the new artifact and version metadata. Cloudflare can build a preview before merge. Automatic updates are optional and validate the version, JavaScript syntax, and Wrangler dry run before reaching production. That is a sensible delivery mechanism, although reviewing an obfuscated artifact is not equivalent to reviewing maintainable source.
The free-plan claim also needs a boundary. A plain Worker cannot carry the UDP needed for voice and video calls. Nova offers WARP routing, while full backend mode requires the operator's own Xray or sing-box VPS. At that point the setup includes a server, its security, and its bill. Cloudflare usage limits, domain filtering, and provider enforcement remain external dependencies even though no shared Nova server sits in the middle.
The source and license change the decision
Nova Proxy describes itself as using a protected-panel model. The public repository contains a minified and obfuscated worker.js release artifact, deployment files, checksums, and documentation. The maintainable panel source is private. Releases through 4.2.0 retain their historical MIT grant, but Nova-authored changes from 4.3.0 use PolyForm Noncommercial. Personal, educational, charitable, and other permitted noncommercial uses fit; resale and paid hosting require written permission.
That makes the current project source-available in a limited sense, not an ordinary open-source package that a company can audit, modify from maintainable source, and deploy under an OSI-style license. The checksum proves that a downloaded artifact matches the published artifact. It does not establish how that artifact was produced or make the underlying source reviewable. This distinction matters more for a proxy than for a cosmetic dashboard because the Worker handles connection configuration and sensitive subscription credentials.
The documentation compounds the concern. The current README plainly says worker.js is obfuscated and the maintainable source is private. SECURITY.md says the same file is complete, unminified source with no bundler or obfuscation. Those statements cannot both describe the current release. SECURITY.md also says the admin password is stored in cleartext in the owner's D1/KV or Worker secret because session signatures derive from it. Cloudflare account access is already powerful, but teams with password-at-rest requirements will reasonably reject that design.
Active development, with visible operational risk
The repository had about 3,046 stars and was pushed on August 16, 2026. Version 4.7.3 was released the same day, following several releases in one week. The queue contained 36 open issues and two open pull requests. Reports were also being created and updated in August, so this is active software with an active support burden, not a quiet finished appliance.
Recent release notes show meaningful hardening: a forged Telegram login was fixed in 4.6.3, first-time setup routes were tightened in 4.6.4, and later work added safer diagnostics and recovery changes. Rapid fixes are encouraging, but the nature and pace of them argue for previewing updates instead of enabling automatic production deployment. An August 16 report against 4.7.2 described an npm ci lockfile mismatch during Cloudflare deployment. Version 4.7.3 followed later that day with general setup and recovery fixes, so a new user should test the current fork rather than assume the earlier report still reproduces.
Nova Proxy is easiest to recommend to an individual who needs a capable panel quickly, accepts noncommercial terms, and understands Cloudflare. It is difficult to recommend where verifiable source, commercial rights, hashed credentials, or stable documentation are requirements. The product design is practical. The trust model is the purchase decision.