Nova Proxy: A Self-Hosted Cloudflare Worker for Censorship-Resistant Access

What Nova Proxy actually solves

Nova Proxy is for people who need a censorship-resistant proxy but do not want to rent a VPS or trust a shared commercial service. It runs entirely on a Cloudflare Worker under your own free account, so bandwidth, domain, and data stay under your control. The README is explicit that there is no shared server and no middleman. The target user is someone in a high-censorship network like Iran who wants to hand out subscription links to friends or family without managing a server. The panel creates users, assigns quotas and expiry dates, and generates per-user links that work with common clients. It is a control panel and edge worker combined, not just a single protocol implementation.

The protocol and routing mix inside one link

The core trick is that one subscription link can carry both VLESS and Trojan simultaneously. If a filter blocks one protocol, the client falls back to the other. The README also lists Shadowsocks, gRPC, and XHTTP over WebSocket with TLS. This is not a proxy server in the traditional sense; it is a Cloudflare Worker that routes traffic through the edge. The worker supports a 'Resistance Policy' with toggles for port spread, domestic bypass, and ad blocking. The release notes for 4.5.2 mention that QUIC now drives the real block, and the policy was trimmed to toggles that actually work. That suggests the project iterates based on real-world filtering behavior, which is useful but also means the configuration may change between releases.

Deployment: three paths, all free

The README gives three deployment options. Option A is a one-click Deploy to Cloudflare button that creates the Worker, KV namespace, and D1 database automatically. Option B uses a Telegram bot installer. Option C is the Wrangler CLI: run `npm install -g wrangler`, `wrangler login`, then `npm ci` and `npm run deploy` in the project directory. The documentation states that Wrangler provisions KV and D1 bindings automatically. After deployment, you open `https://<your-worker>.workers.dev/admin` to finish setup and set an admin login. The deployment flow is designed so you never paste a Cloudflare API token into Nova itself. That is a meaningful security property, but it also means you must trust the one-click flow to create the right bindings.

The admin panel and user management model

The panel is bilingual in English, Persian, and Russian. It supports multi-user accounts with per-user quota, expiry, and daily limits. Each user gets a private subscription link that can be exported as Auto, Base64, or Clash format. The README recommends Nova Client for the best experience but says any standard client that reads Base64 or Clash works. There is also a Telegram bot that can add, edit, extend, or delete users, with the same three languages. The panel includes Nova Radar, an in-browser scanner that finds fast clean Cloudflare IPs for the current network and applies them per user. This is a practical feature for ISPs that throttle specific IP ranges. The per-user link is treated as a credential, and the README warns not to share admin logins.

WARP, calls, and the UDP limitation

A plain free Cloudflare Worker cannot carry UDP, which is required for voice and video calls in FaceTime, WhatsApp, and Telegram. Nova Proxy addresses this with an optional WARP node or a backend mode that routes through your own server. The README states that Calls support is optional and that you must enable the WARP node or a backend server for voice and video. This is a real limitation: the free worker alone is not enough for full call quality. The backend mode is described as 'full-quality routing through your own server,' which implies you need a separate server for that path. If you only need basic browsing and messaging, the free worker may suffice, but the moment you add calls, you need extra infrastructure.

Self-healing links and GitHub mirror failover

Two features address the problem of domains getting blocked. First, self-healing links: if the worker domain changes or a host goes down, the config falls back to a working address automatically. Second, GitHub mirror failover: the panel can publish your subscription to a GitHub repository, giving users a permanent `raw.githubusercontent.com` link even if your domain is filtered. This is a clever use of GitHub as a static host for subscription files. The README does not explain the exact mechanism for self-healing, but the concept is that the config contains multiple addresses and the client tries them in order. This is useful in practice, but it also means your subscription link may depend on a third-party service like GitHub, which could be blocked in some regions.

The protected source and the licensing shift

The public repository contains a minified and obfuscated `worker.js` deployment artifact, not the maintainable source. The README is honest that the protection deters copying but does not make the code impossible to recover. Any Cloudflare account owner can inspect a Worker running in their own account, so the obfuscation is a deterrent, not a guarantee. The license changed at version 4.3.0: versions through 4.2.0 remain MIT, but Nova-authored changes from 4.3.0 onward are under PolyForm Noncommercial. That means you can self-host, study, and modify for noncommercial use, but you cannot resell access or run paid hosting without written permission. This is a critical consideration if you are evaluating the project for a commercial service. The README also mentions 'verified helpers' that stay open, but the panel itself is closed.

Maintenance, updates, and the daily action

The project uses a daily GitHub Action called 'Check for Nova updates' in repositories created from this project. When a new release is available, it opens a pull request containing only `worker.js` and `version.json`. You review the diff and a Cloudflare preview, then merge to deploy through Workers Builds. There is also an optional automatic mode for nontechnical users, enabled with one repository variable. The release notes for the latest version, 4.7.4, are not detailed in the README, but the pattern of frequent releases (three in August 2026) suggests active maintenance. The update process is designed to be reviewable, which is good for security, but it also means you must keep an eye on the pull requests. The README points to DEPLOY.md for rollback instructions, but the truncated material does not include them.

Editorial conclusion

Adopt Nova Proxy if you want a self-hosted, multi-user proxy panel on Cloudflare's free plan and are comfortable with an obfuscated worker.js and a noncommercial license. Do not adopt it if you need to audit or modify the panel source, if you must resell access, or if your workload requires UDP without a WARP or backend node. Before deploying, verify the current license terms in the repository, confirm that the daily update GitHub Action works in your fork, and test that the worker's D1 and KV bindings are created correctly by Wrangler or the one-click flow.

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes