Remnawave Admin 5.2.0

October 9, 2026 · GitHub release · discussion in Telegram

A release about what an admin works with every day. Telegram notifications became cards with tables, colored buttons and fields you copy with a tap. The violation card shows the connections that caused it. Automations learned to spare paying customers, and the hard action for sharing now counts from the customer's device limit. Plus the Bedolaga event feed, a vector map and fixes for mail, violations, torrents and analytics.

Before upgrading

Read the Important section: Bedolaga sections are closed to admins with restricted user visibility, the new torrent threshold is on by default, and unsubscribing no longer silences transactional emails.

✨ New

Telegram notifications as cards

Every notification, from violations to backups, arrives as a rich card:

• the main fields go into a table and secondary details into collapsible sections; user changes come as a “before → after” table with the old value struck through and the new one highlighted;
• the customer's words in a ticket, the start of an incoming email and the reason for an address block are quotes with an author;
• times are shown in the reader's time zone;
• attachments live inside the card: the subscription QR code of a new user, the customer's screenshot in a ticket, the backup file itself;
• action buttons sit right in the card and are colored by meaning: red ones punish, green ones clear suspicion; after a tap the card changes in place — the buttons go away and a note about the action appears inside;
• username, UUID, email, description, Telegram ID, IP addresses, HWID and node addresses are copied with a tap, and the Telegram ID has a profile link next to it; the subscription link is copied too, but only a “Copy” button is visible;
• notifications sent by the web panel (violations, the HWID and address guards, finance, support, backups, mail) use the bot language — they used to be Russian only.

If Telegram rejects a card, a regular message with the same data and buttons under it goes out instead. Cards can be turned off entirely with the “Rich notification styling” setting. Plugins can color their buttons with the style field of an action (plugin API).

The violation card shows where it came from

The “simultaneous connections from different countries” reason used to be a line of text. Now the violation card has:

• the “Connections behind the violation” block: for the geo analyzer — connections from different countries at the same time and the ends of an impossible trip, for the temporal one — addresses that were online together (with the carrier pool), for ASN — addresses via hosting, VPN, corporate and backbone networks; each connection has its country, city, carrier, node and time;
• the “Addresses around the violation” summary for an hour before and after: first and last appearance of each address, number of connections, nodes;
• the country and network type of each connection in the event feed;
• “Updated” next to “Added” for devices.

Evidence exists only for violations recorded after the upgrade. Idea by @chudo-arky (#306).

Actions spare paying customers

The “Warn”, “Block user”, “Disable user” and “Limit speed” actions in violation rules have two checkboxes: “Skip if the customer already has a paid subscription” and “Skip if the customer paid after the trigger”. The first is checked right away, both before a delayed step. A payment is a Bedolaga transaction since the trigger: a top-up or a subscription payment above zero (zero ones are written when an admin grants a subscription). Without Bedolaga, a live subscription without a trial tag or squad counts as paid. A person's accounts are found by Telegram ID, without it — by email. Paying accomplices are spared too, and the automations log shows that a step was skipped because of a payment.

A rule only about trial farming no longer needs workarounds: the violation event carries the triggered hard-action rules, the violation kind and the trial-abuse type, and in the rule builder these are the “Trial abuse” and “Triggered hard-block rules” condition fields with values picked from a list. Thanks to @fesevu (#308). More in Anti-abuse.

Hard action for sharing — from the device limit

The new “Hard block: sources above the device limit” setting (violations_hard_block_simultaneous_excess, 0 — off): a hard action when simultaneous sources exceed the customer's device limit by more than N and also go past the threshold with the network-change and CGNAT buffers. A limit of 1 and a limit of 10 are now each measured against their own value instead of one absolute threshold. Customers with unlimited devices are not affected.

The threshold breakdown — addresses and sources, device limit, buffers, final threshold, excess — comes with the violation event: automation conditions are built on it, and the values can be put into the notification text. Thanks to @fesevu (#309).

Bedolaga event feed

The Bedolaga dashboard has an “Event feed” card: purchases, renewals, top-ups, trials, promo codes, campaigns, promo group changes — everything the bot records about customers on its own. Filters by event groups, “Show more”, a refresh every minute; a name leads to the customer card, payments and bonuses differ in color. Events in the activity feed of the customer card are now translated and detailed instead of the bot's English title. It needs bot 2.8.0 or newer and the bedolaga_customers:view permission — events contain customer names and amounts. Purchases, trials and promo codes from the cabinet and the mini app are recorded by the bot only when admin notifications are enabled in Bedolaga (ADMIN_NOTIFICATIONS_ENABLED).

Vector map of countries and regions

“Geography” is drawn with a vector map of countries and regions instead of CARTO tiles — a map key is no longer needed. Crimea and Sevastopol are subjects of Russia, both on the map and for addresses that GeoIP databases attribute to Ukraine. Thanks to @chudo-arky (#296).

Removed devices can be erased

Unlinked devices are kept for trial-farming detection, and the detector keeps linking accounts through them: the case with a customer is settled, they removed the devices, yet violations keep coming. The “Removed” tab in a user's devices now has a trash button on each device and “Clear removed” with a confirmation. Active devices and the panel are not touched; it needs the users:edit permission.

🔧 Improvements

• “Events per address” threshold for torrents — the “Events per address (exchange depth)” setting (torrent_min_events_per_peer, default 1.5; 1 — do not check): a game launcher and DHT polling touch each address once, while a torrent client downloads from the same peers for a long time (Torrents)
• Payment reminder hour — the “Reminder hour” setting (finance_reminder_hour, 0–23, default 10): reminders go out from that hour in the panel time zone, and if the panel was off at that hour — right after it starts. Thanks to @chudo-arky (#304)
• Clear passkey errors — WebAuthn refusals have their own texts: domain not recognized, request expired, key not found, verification failed (with the reason) — instead of “Access denied”; the panel address for passkeys (webauthn_rp_id, webauthn_origin) is set in Settings → Security → Authentication methods
• Your own GeoLite2 mirrors — MAXMIND_MIRROR_URL (a template with {edition}) is tried first; a downloaded file is saved only if it is a real MaxMind database — an HTML stub with code 200 will not overwrite a working database
• Links from notifications — violation, torrent and traffic notifications lead to the user card, finance ones to Finance, backup ones to Backups
• Bedolaga customer search by email — the panel asks the bot's search and matches the email exactly; walking through pages stays as a fallback for versions without email search (email search is proposed to Bedolaga)
• “Shared simultaneous IP limit” — the violations_max_simultaneous_ips setting is named and described honestly: it is a shared limit instead of the device limit, not an addition to it; the behavior did not change
• Documentation — a separate chapter Warnings via Bedolaga: linking the panel and the bot both ways, texts, delivery, the banner in the cabinet, a one-request check; Anti-abuse covers the payment checkboxes, trial-abuse conditions, the threshold from the device limit, evidence in the violation card and clearing removed devices

🐛 Fixes

• fixed an error (violations other than torrents did not store the customer's Telegram ID: a manual warning answered that there was nobody to send to, and the delayed action after a warning was not queued; old violations get their recipient back during the upgrade) — thanks to @fesevu (#310)
• fixed an error (the violation card said “IP addresses: 0” with two countries in the reasons — addresses were saved from other connections than the ones the detector saw, and the scoring breakdown was not saved at all) — thanks to @chudo-arky (#307)
• fixed an error (after “Annul”, the “Bot/script in User-Agent” violation came back every half hour; annulling now also accepts that customer's User-Agent as legitimate)
• fixed an error (an annulled torrent violation was immediately born again from the same events)
• fixed an error (a torrent violation showed a handful of events and addresses on the web while the Telegram notification showed hundreds)
• fixed an error (identical torrent violations within 10 minutes were not merged into one)
• fixed an error (the War Thunder launcher, which downloads patches over BitTorrent, raised torrent violations)
• fixed an error (empty values in automation notification texts were shown as “None”)
• fixed an error (the bot answered 404 to internal requests: the collector lost panel events, and notifications went to Telegram bypassing the bot) — thanks to @latham5656 (#292)
• fixed an error (after an upgrade with a migration, the backend stopped writing backend.log and violations.log until a restart) — thanks to @latham5656 (#293)
• fixed an error (behind an external TLS proxy passkeys could not be registered, and cookies went out without the Secure flag) — thanks to @chudo-arky (#300)
• fixed an error (an email being sent at the moment of a restart stayed in the sending state forever) — thanks to @chudo-arky (#301)
• fixed an error (the List-Unsubscribe-Post header was set without an https unsubscribe link)
• fixed an error (payment reminders arrived at night: the day was counted in UTC) — thanks to @chudo-arky (#304)
• fixed an error (the 7- and 30-day traffic chart ended with an empty tomorrow and dropped to zero) — thanks to @Zmey-GopbIH (#302)
• fixed an error (the traffic change percentage on the dashboard was understated: “yesterday” included today's traffic)
• fixed an error (the fallback per-day traffic series added each day to the next one)
• fixed an error (clicking a notification did not mark it as read and led nowhere, and email notifications led to a page that does not exist)
• fixed an error (on a phone, “Geography” in analytics went off the screen)
• fixed an error (on a phone, the headers of “Trends” and “Top users” and the date picker in analytics did not fit the screen)
• fixed an error (the labels of the “Users / IP addresses / Share” tiles in analytics overlapped, and city counts were not declined properly in Russian)
• fixed an error (updating the GeoLite2 databases failed: the ltsdev/maxmind mirror was deleted and MaxMind does not register users from Russia — the databases now come from live mirrors)
• fixed an error (the Bedolaga transaction filter by type did not work)
• fixed an error (“N min ago” in the Bedolaga customer card was not translated)
• fixed an error (device delete buttons in the user card were shown without the users:edit permission)

🛡 Security

• Bedolaga and restricted visibility — an admin who sees only part of the users could see all Bedolaga customers, their payments, referrals and tickets with Bedolaga permissions. Bedolaga customers cannot be filtered by that admin's visibility (they are linked to panel users by Telegram ID at most), so Bedolaga permissions no longer apply to such an admin. Referrals require bedolaga_customers:view, not the basic bedolaga:view.
• Unsubscribing cannot be forged — an address is added to the unsubscribed list only if the email to unsubscribe@ passed SPF or DMARC and is not marked suspicious: before, any server could unsubscribe someone else's address with a single MAIL FROM, and emails to it stopped. A DKIM signature of another domain does not count for this. Thanks to @chudo-arky (#301)
• Submission keeps the sender domain — the domain restriction is also checked against the From header that goes into the email, not only against the envelope. Thanks to @chudo-arky (#301)
• Violation emails only to a verified address — Bedolaga 4.16.0+ does not write to an unverified email (anyone could have typed it), while the panel sent its own email to the same address. Now it does not, and the operator sees the “email not verified” reason.

⚠️ Important

• Take a database backup before upgrading. Migrations run on their own at the first start and also restore recipients of old violations; rolling back to 5.1.1 is possible only from the backup.
• Bedolaga sections are closed to admins with restricted user visibility. If such an admin needs Bedolaga, lift their visibility restriction.
• The new torrent threshold is on by default. Windows with fewer than 1.5 events per address on average do not raise violations. To get the old behavior back, set “Events per address” to 1.
• Unsubscribing no longer silences transactional emails. Codes, replies, notifications, an administrator's personal emails and violation warnings reach unsubscribed addresses too. Emails sent via submission with mailing-list headers (Precedence: bulk, List-Id, List-Unsubscribe) respect the unsubscribe.
• A map key is no longer needed — the map_tiles_api_key setting was removed together with the CARTO tiles.
• Update both the bot and the web panel — notification cards and their buttons work only when both parts are new; docker compose pull updates both.
• Bedolaga. The event feed works with bot 2.8.0 or newer, warnings via the bot — with 4.16.0 (details in Warnings via Bedolaga).

📦 Upgrade

docker compose pull
docker compose up -d

Node agents do not need an update. Details in Upgrade.