Self-hosted VPN Service
Users sign up and manage devices through a Telegram bot. The backend owns subscriptions, device limits, and key lifecycle; a Go agent on each server does the provisioning.
- Backend — .NET 8, clean architecture (Domain / Application / Infrastructure / Presentation), PostgreSQL, Docker Compose.
- Client — Telegram bot. No app to install, no dashboard to maintain.
- Node agent — Go, talking to Xray-core over gRPC to add and revoke VLESS users. Backend↔agent calls are signed with HMAC-SHA256.
The split is the useful part: .NET owns billing and state, the agent owns nothing and can be rebuilt from the database. Revocation is idempotent and bulk-capable, so a lapsed subscription cleans up across every node without partial-failure headaches.