From edd6f2f640861efe230ad4ad5413f6308d620921 Mon Sep 17 00:00:00 2001
From: leonidorlov-hash <leonidorlov-hash@users.noreply.github.com>
Date: Mon, 14 Sep 2026 14:31:06 +0300
Subject: [PATCH 1/5] feat(servers): opt-in live peer refresh interval (default
 off)

The connections list used to poll every 5s unconditionally. Each poll is a
full connections read over SSH - fine on fast servers, heavy on slow/flaky
ones. The management modal now offers a per-server interval selector:
0 (off, default), 5, 10, 15, 20, 45, 120, 300, 600 seconds. Stored as
server['peer_poll_interval'], validated server-side against the step list,
i18n for all five locales.
---
 app.py                | 29 +++++++++++++++++++++++++
 templates/server.html | 50 ++++++++++++++++++++++++++++++++++++++-----
 translations/en.json  |  6 +++++-
 translations/fa.json  |  6 +++++-
 translations/fr.json  |  6 +++++-
 translations/ru.json  |  6 +++++-
 translations/zh.json  |  6 +++++-
 7 files changed, 99 insertions(+), 10 deletions(-)

diff --git a/app.py b/app.py
index cfe9079..de4ab75 100644
--- a/app.py
+++ b/app.py
@@ -4378,6 +4378,35 @@ async def api_ssh_cooldown(request: Request, server_id: int):
     return {'ok': True, 'ssh_cooldown_base': seconds}
 
 
+# Allowed live peer-list refresh intervals (seconds); 0 disables polling.
+PEER_POLL_INTERVALS = (0, 5, 10, 15, 20, 45, 120, 300, 600)
+
+
+@app.post('/api/servers/{server_id}/peer_poll_interval', tags=["Servers"])
+async def api_peer_poll_interval(request: Request, server_id: int):
+    """Set the per-server live peer-list refresh interval (0 = off).
+
+    Polling is opt-in: every poll is a full connections read over SSH, which
+    is cheap on fast servers but painful on slow/flaky ones."""
+    if not _check_admin(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    try:
+        body = await request.json()
+        seconds = int(body.get('seconds', 0))
+    except Exception:
+        return JSONResponse({'error': 'Invalid value'}, status_code=400)
+    if seconds not in PEER_POLL_INTERVALS:
+        return JSONResponse(
+            {'error': 'Value must be one of ' + ','.join(map(str, PEER_POLL_INTERVALS))},
+            status_code=400)
+    data = load_data()
+    if server_id >= len(data['servers']):
+        return JSONResponse({'error': 'Server not found'}, status_code=404)
+    data['servers'][server_id]['peer_poll_interval'] = seconds
+    save_data(data)
+    return {'ok': True, 'peer_poll_interval': seconds}
+
+
 @app.post('/api/servers/{server_id}/host_tuning', tags=["Protocols"])
 def api_host_tuning(request: Request, server_id: int):
     """Server-level network tuning summary (host sysctls + AWG containers)."""
diff --git a/templates/server.html b/templates/server.html
index 3b36875..467fc59 100644
--- a/templates/server.html
+++ b/templates/server.html
@@ -1263,6 +1263,9 @@
 <script>
     const SERVER_ID = {{ server_id }};
     let SSH_COOLDOWN_BASE = {{ (server.get('ssh_cooldown_base') or 30) | tojson }};
+    // Live peer-list refresh interval in seconds; 0 = off (opt-in per server).
+    let PEER_POLL_INTERVAL = {{ (server.get('peer_poll_interval') or 0) | tojson }};
+    const PEER_POLL_STEPS = [0, 5, 10, 15, 20, 45, 120, 300, 600];
     document.body.dataset.serverUid = {{ (server.uid or '') | tojson }};
     const SERVER_HOST = "{{ server.host }}";
     const CUSTOM_PROTO_NAMES = {
@@ -1458,10 +1461,46 @@
                     </div>
                     <div class="text-muted" style="font-size:0.78rem; margin-top:6px;">${_('ssh_cooldown_hint')}</div>
                 </div>
+                <div style="margin-top: var(--space-md); padding-top: var(--space-md); border-top: 1px solid var(--border);">
+                    <label for="peerPollSelect" style="display:block; font-size:0.85rem; margin-bottom:6px;">${_('peer_poll_title')}</label>
+                    <div class="flex" style="gap:8px;">
+                        <select class="form-select" id="peerPollSelect" style="max-width:160px;">
+                            ${PEER_POLL_STEPS.map(s => `<option value="${s}"${s === PEER_POLL_INTERVAL ? ' selected' : ''}>${s === 0 ? _('peer_poll_off') : s + ' ' + _('peer_poll_sec')}</option>`).join('')}
+                        </select>
+                        <button class="btn btn-secondary btn-sm" onclick="savePeerPollInterval()" id="peerPollSaveBtn">💾</button>
+                    </div>
+                    <div class="text-muted" style="font-size:0.78rem; margin-top:6px;">${_('peer_poll_hint')}</div>
+                </div>
             </div>
         `;
     }
 
+    async function savePeerPollInterval() {
+        const select = document.getElementById('peerPollSelect');
+        const btn = document.getElementById('peerPollSaveBtn');
+        if (!select) return;
+        const seconds = parseInt(select.value, 10);
+        if (!PEER_POLL_STEPS.includes(seconds)) {
+            showToast(_('peer_poll_title') + ': ' + PEER_POLL_STEPS.join('/'), 'error');
+            return;
+        }
+        if (btn) { btn.disabled = true; btn.innerHTML = '<div class="spinner"></div>'; }
+        try {
+            const res = await apiCall(`/api/servers/${SERVER_ID}/peer_poll_interval`, 'POST', { seconds });
+            PEER_POLL_INTERVAL = res.peer_poll_interval;
+            // Reschedule (or stop) the live refresh with the new interval.
+            clearTimeout(window.connPollTimer);
+            if (PEER_POLL_INTERVAL > 0 && document.getElementById('connectionsSection').style.display !== 'none') {
+                window.connPollTimer = setTimeout(function() { loadConnections(true); }, PEER_POLL_INTERVAL * 1000);
+            }
+            showToast('✓', 'success');
+        } catch (err) {
+            showToast(_('error') + ': ' + err.message, 'error');
+        } finally {
+            if (btn) { btn.disabled = false; btn.textContent = '💾'; }
+        }
+    }
+
     async function saveSshCooldown() {
         const input = document.getElementById('sshCooldownInput');
         const btn = document.getElementById('sshCooldownSaveBtn');
@@ -3147,8 +3186,8 @@
         // the editor's own save path, which wants an immediate silent refresh.
         if (isPoll && !force && document.querySelector('#connectionsListInner .rename-editor')) {
             clearTimeout(window.connPollTimer);
-            if (document.getElementById('connectionsSection').style.display !== 'none') {
-                window.connPollTimer = setTimeout(function() { loadConnections(true); }, 5000);
+            if (PEER_POLL_INTERVAL > 0 && document.getElementById('connectionsSection').style.display !== 'none') {
+                window.connPollTimer = setTimeout(function() { loadConnections(true); }, PEER_POLL_INTERVAL * 1000);
             }
             return;
         }
@@ -3267,10 +3306,11 @@
         } finally {
             window.connLoading = false;
             highlightPeerFromQuery();
-            // Auto-refresh every 5s while the connections section is visible (live speed/handshake)
+            // Live refresh while the connections section is visible; the
+            // interval is opt-in per server (0 = off, management modal).
             clearTimeout(window.connPollTimer);
-            if (document.getElementById('connectionsSection').style.display !== 'none') {
-                window.connPollTimer = setTimeout(function() { loadConnections(true); }, 5000);
+            if (PEER_POLL_INTERVAL > 0 && document.getElementById('connectionsSection').style.display !== 'none') {
+                window.connPollTimer = setTimeout(function() { loadConnections(true); }, PEER_POLL_INTERVAL * 1000);
             }
         }
     }
diff --git a/translations/en.json b/translations/en.json
index 2e34266..771c285 100644
--- a/translations/en.json
+++ b/translations/en.json
@@ -606,5 +606,9 @@
   "stop_peer_title": "Stop",
   "start_peer_title": "Enable",
   "ssh_cooldown_title": "SSH cooldown (sec)",
-  "ssh_cooldown_hint": "Initial delay before reconnecting to an unreachable server. Do not change if the server works fine."
+  "ssh_cooldown_hint": "Initial delay before reconnecting to an unreachable server. Do not change if the server works fine.",
+  "peer_poll_title": "Live peer refresh",
+  "peer_poll_hint": "How often the peer list refreshes itself. 0 = off (default). 5–10 is fine on fast servers; on slow ones use 300–600 or keep it off.",
+  "peer_poll_off": "off",
+  "peer_poll_sec": "sec"
 }
diff --git a/translations/fa.json b/translations/fa.json
index 30ce84e..87607c2 100644
--- a/translations/fa.json
+++ b/translations/fa.json
@@ -573,5 +573,9 @@
   "stop_peer_title": "توقف",
   "start_peer_title": "فعال‌سازی",
   "ssh_cooldown_title": "SSH cooldown (ثانیه)",
-  "ssh_cooldown_hint": "تأخیر اولیه قبل از اتصال مجدد به سرور در دسترس‌نبوده. اگر سرور درست کار می‌کند، تغییر ندهید."
+  "ssh_cooldown_hint": "تأخیر اولیه قبل از اتصال مجدد به سرور در دسترس‌نبوده. اگر سرور درست کار می‌کند، تغییر ندهید.",
+  "peer_poll_title": "به‌روزرسانی زنده پیرها",
+  "peer_poll_hint": "هر چند ثانیه فهرست پیرها خودکار تازه شود. 0 = خاموش (پیش‌فرض). در سرورهای سریع 5–10 کافی است؛ در سرورهای کند 300–600 بگذارید یا خاموش بماند.",
+  "peer_poll_off": "خاموش",
+  "peer_poll_sec": "ثانیه"
 }
diff --git a/translations/fr.json b/translations/fr.json
index c9da6f6..75b066e 100644
--- a/translations/fr.json
+++ b/translations/fr.json
@@ -573,5 +573,9 @@
   "stop_peer_title": "Arrêter",
   "start_peer_title": "Activer",
   "ssh_cooldown_title": "SSH cooldown (s)",
-  "ssh_cooldown_hint": "Délai initial avant reconnexion à un serveur injoignable. Ne modifiez pas si le serveur fonctionne correctement."
+  "ssh_cooldown_hint": "Délai initial avant reconnexion à un serveur injoignable. Ne modifiez pas si le serveur fonctionne correctement.",
+  "peer_poll_title": "Actualisation en direct des pairs",
+  "peer_poll_hint": "Fréquence de rafraîchissement automatique de la liste des pairs. 0 = désactivé (par défaut). 5–10 suffit sur les serveurs rapides ; sur les lents, utilisez 300–600 ou laissez désactivé.",
+  "peer_poll_off": "désactivé",
+  "peer_poll_sec": "s"
 }
diff --git a/translations/ru.json b/translations/ru.json
index 622d13e..7adb19d 100644
--- a/translations/ru.json
+++ b/translations/ru.json
@@ -606,5 +606,9 @@
   "stop_peer_title": "Остановить",
   "start_peer_title": "Включить",
   "ssh_cooldown_title": "SSH cooldown (сек)",
-  "ssh_cooldown_hint": "Начальная пауза перед повторным подключением к недоступному серверу. Не меняйте, если сервер работает корректно."
+  "ssh_cooldown_hint": "Начальная пауза перед повторным подключением к недоступному серверу. Не меняйте, если сервер работает корректно.",
+  "peer_poll_title": "Живое обновление пиров",
+  "peer_poll_hint": "Как часто список пиров обновляется сам. 0 = выключено (по умолчанию). На быстрых серверах хватит 5–10, на медленных ставьте 300–600 или не включайте вовсе.",
+  "peer_poll_off": "выключено",
+  "peer_poll_sec": "сек"
 }
diff --git a/translations/zh.json b/translations/zh.json
index 92ca252..055d9ca 100644
--- a/translations/zh.json
+++ b/translations/zh.json
@@ -573,5 +573,9 @@
   "stop_peer_title": "停止",
   "start_peer_title": "启用",
   "ssh_cooldown_title": "SSH 冷却时间(秒)",
-  "ssh_cooldown_hint": "重新连接不可达服务器前的初始延迟。如果服务器工作正常,请勿更改。"
+  "ssh_cooldown_hint": "重新连接不可达服务器前的初始延迟。如果服务器工作正常,请勿更改。",
+  "peer_poll_title": "节点实时刷新",
+  "peer_poll_hint": "节点列表自动刷新的间隔。0 = 关闭(默认)。快的服务器用 5–10 即可;慢的服务器建议 300–600 或保持关闭。",
+  "peer_poll_off": "关闭",
+  "peer_poll_sec": "秒"
 }

From 0c5c3440d34c10c22bd2cf305142aa895defd347 Mon Sep 17 00:00:00 2001
From: leonidorlov-hash <leonidorlov-hash@users.noreply.github.com>
Date: Mon, 14 Sep 2026 13:10:00 +0300
Subject: [PATCH 2/5] fix(awg): docker build timeout 300s -> 900s + honest
 timeout error

Slow registry pulls (flaky routes) exceeded the 300s build timeout; the
killed build left a mid-download stderr fragment - or nothing - as the
'error'. The build now gets 900s, and a timeout-killed build reports
the timeout explicitly with the stdout tail instead of an empty error.
---
 managers/awg_manager.py | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/managers/awg_manager.py b/managers/awg_manager.py
index 51c685d..86d581d 100644
--- a/managers/awg_manager.py
+++ b/managers/awg_manager.py
@@ -1086,10 +1086,16 @@ done
 
         out, err, code = self.ssh.run_sudo_command(
             f"docker build --no-cache --pull -t {container_name} {dockerfile_folder}",
-            timeout=300
+            timeout=900
         )
         if code != 0:
-            raise RuntimeError(f"Failed to build container: {err}")
+            # BuildKit writes progress to stderr; a timeout kill leaves no
+            # error text at all - say so explicitly and show the stdout tail.
+            detail = (err or '').strip() or (
+                f"no error output (possibly killed by the 900s timeout). "
+                f"Last output: ...{(out or '')[-500:]}"
+            )
+            raise RuntimeError(f"Failed to build container: {detail}")
         results.append("Docker image built successfully")
 
         # Step 5: Run container

From fd96acad003e6de6516cc16a688d27449054a1f5 Mon Sep 17 00:00:00 2001
From: leonidorlov-hash <leonidorlov-hash@users.noreply.github.com>
Date: Mon, 14 Sep 2026 13:37:50 +0300
Subject: [PATCH 3/5] fix(awg): build via server-side log file + untruncated
 error display

BuildKit progress (megabytes of stderr) no longer streams through the SSH
channel mid-build: output goes to /tmp/docker-build-<name>.log on the server
and only the last 6000 bytes come back. This removes mid-build stalls/deaths
on flaky links and guarantees the real error text survives.

Frontend: clearInterval on the error path (progress lines no longer appear
after the failure) and render the error via textContent so log content can
never be swallowed by HTML parsing.
---
 managers/awg_manager.py | 17 +++++++++++------
 templates/server.html   | 11 +++++++++--
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/managers/awg_manager.py b/managers/awg_manager.py
index 86d581d..47940e0 100644
--- a/managers/awg_manager.py
+++ b/managers/awg_manager.py
@@ -1084,16 +1084,21 @@ done
         self.ssh.run_sudo_command(f"mkdir -p {dockerfile_folder}")
         self.ssh.upload_file_sudo(dockerfile_content, f"{dockerfile_folder}/Dockerfile")
 
+        # Stream the build output to a log file on the server and only tail
+        # it back: BuildKit progress is megabytes of stderr, and pushing that
+        # through the SSH channel both starves the channel window (the command
+        # can stall or die mid-build on flaky links) and loses the actual
+        # error text. The file keeps the full log for post-mortem.
+        build_log = f"/tmp/docker-build-{container_name}.log"
         out, err, code = self.ssh.run_sudo_command(
-            f"docker build --no-cache --pull -t {container_name} {dockerfile_folder}",
+            f"docker build --no-cache --pull -t {container_name} {dockerfile_folder} "
+            f"> {build_log} 2>&1; code=$?; tail -c 6000 {build_log}; exit $code",
             timeout=900
         )
         if code != 0:
-            # BuildKit writes progress to stderr; a timeout kill leaves no
-            # error text at all - say so explicitly and show the stdout tail.
-            detail = (err or '').strip() or (
-                f"no error output (possibly killed by the 900s timeout). "
-                f"Last output: ...{(out or '')[-500:]}"
+            detail = (out or '').strip() or (err or '').strip() or (
+                f"no output at all (possibly killed by the 900s timeout); "
+                f"full log on the server: {build_log}"
             )
             raise RuntimeError(f"Failed to build container: {detail}")
         results.append("Docker image built successfully")
diff --git a/templates/server.html b/templates/server.html
index 3b36875..d8a94cb 100644
--- a/templates/server.html
+++ b/templates/server.html
@@ -2531,6 +2531,7 @@
         logEl.innerHTML = `<div class="log-line info">${_('install_starting')}</div>`;
         fillEl.style.width = '10%';
         fillEl.style.background = '';
+        let progressInterval = null;
         try {
             const progressSteps = [
                 { pct: 20, msg: _('check_docker') },
@@ -2538,7 +2539,7 @@
                 { pct: 50, msg: _('build_container') },
             ];
             let stepIdx = 0;
-            const progressInterval = setInterval(() => {
+            progressInterval = setInterval(() => {
                 if (stepIdx < progressSteps.length) {
                     fillEl.style.width = progressSteps[stepIdx].pct + '%';
                     logEl.innerHTML += `<div class="log-line info">${progressSteps[stepIdx].msg}</div>`;
@@ -2599,9 +2600,15 @@
             document.getElementById('installDone').style.display = '';
             setTimeout(() => checkServer(), 800);
         } catch (err) {
+            clearInterval(progressInterval);
             fillEl.style.width = '100%';
             fillEl.style.background = 'linear-gradient(135deg, #ef4444, #dc2626)';
-            logEl.innerHTML += `<div class="log-line error">✕ ${_('error')}: ${err.message}</div>`;
+            // textContent, not innerHTML: build logs can contain sequences
+            // that parse as HTML and silently swallow the rest of the error.
+            const errDiv = document.createElement('div');
+            errDiv.className = 'log-line error';
+            errDiv.textContent = `✕ ${_('error')}: ${err.message}`;
+            logEl.appendChild(errDiv);
             logEl.scrollTop = logEl.scrollHeight;
             showToast(_('install_error') + err.message, 'error');
             document.getElementById('installDone').style.display = '';

From 84175817af8e4fa1dd342cadf4d842384dabcbdc Mon Sep 17 00:00:00 2001
From: leonidorlov-hash <leonidorlov-hash@users.noreply.github.com>
Date: Mon, 14 Sep 2026 14:09:36 +0300
Subject: [PATCH 4/5] fix(awg): run docker build detached, poll for exit code

On flaky links the SSH channel dies seconds into the build while the docker
daemon keeps building to success - a synchronous wait reported a false
failure (observed on EUROBYTE: channel closed 2s in, image built fine).
Start the build under nohup with the exit code written to a file and poll
that file; every poll is a fresh short channel, so transport drops can no
longer falsify the build result. Build log stays on the server for
post-mortem; failures return the log tail.
---
 managers/awg_manager.py | 44 ++++++++++++++++++++++++++++-------------
 1 file changed, 30 insertions(+), 14 deletions(-)

diff --git a/managers/awg_manager.py b/managers/awg_manager.py
index 47940e0..d9d2ee0 100644
--- a/managers/awg_manager.py
+++ b/managers/awg_manager.py
@@ -1084,22 +1084,38 @@ done
         self.ssh.run_sudo_command(f"mkdir -p {dockerfile_folder}")
         self.ssh.upload_file_sudo(dockerfile_content, f"{dockerfile_folder}/Dockerfile")
 
-        # Stream the build output to a log file on the server and only tail
-        # it back: BuildKit progress is megabytes of stderr, and pushing that
-        # through the SSH channel both starves the channel window (the command
-        # can stall or die mid-build on flaky links) and loses the actual
-        # error text. The file keeps the full log for post-mortem.
+        # Run the build detached and poll for its exit code. On flaky links
+        # the SSH channel dies seconds into the build while the docker daemon
+        # keeps building - a synchronous wait then reports a false failure
+        # for a build that actually succeeded. Detached, the build is immune
+        # to channel/transport drops; each poll is a fresh short channel.
         build_log = f"/tmp/docker-build-{container_name}.log"
-        out, err, code = self.ssh.run_sudo_command(
-            f"docker build --no-cache --pull -t {container_name} {dockerfile_folder} "
-            f"> {build_log} 2>&1; code=$?; tail -c 6000 {build_log}; exit $code",
-            timeout=900
+        code_file = f"{build_log}.code"
+        self.ssh.run_sudo_command(f"rm -f {build_log} {code_file}")
+        self.ssh.run_sudo_command(
+            f"nohup sh -c 'docker build --no-cache --pull -t {container_name} "
+            f"{dockerfile_folder} > {build_log} 2>&1; echo $? > {code_file}' "
+            f">/dev/null 2>&1 &",
+            timeout=30
         )
-        if code != 0:
-            detail = (out or '').strip() or (err or '').strip() or (
-                f"no output at all (possibly killed by the 900s timeout); "
-                f"full log on the server: {build_log}"
-            )
+        build_code = None
+        deadline = time.time() + 900
+        while time.time() < deadline:
+            time.sleep(5)
+            out, err, code = self.ssh.run_sudo_command(
+                f"cat {code_file} 2>/dev/null", timeout=30)
+            if code == 0 and (out or '').strip().isdigit():
+                build_code = int(out.strip())
+                break
+        if build_code is None:
+            raise RuntimeError(
+                f"Build did not finish within 900s; "
+                f"full log on the server: {build_log}")
+        if build_code != 0:
+            out, err, _ = self.ssh.run_sudo_command(
+                f"tail -c 6000 {build_log}", timeout=30)
+            detail = (out or '').strip() or (
+                f"no output; full log on the server: {build_log}")
             raise RuntimeError(f"Failed to build container: {detail}")
         results.append("Docker image built successfully")
 

From 959ec78e3e081ea813473a8a14a410e58245452e Mon Sep 17 00:00:00 2001
From: Almeonamy <almeonamy@gmail.com>
Date: Fri, 18 Sep 2026 14:08:54 +0700
Subject: [PATCH 5/5] feat(protocols): per-instance public address for client
 endpoints

Every config and link the panel issues carried the address it opens SSH
to. That is not always where clients can reach the instance: a second IP
on the same box, a port forward, a domain name. Telemt made it worse --
it prints its own tg:// links, and install rewrote public_host in
config.toml with the panel's address, so a manually bound instance
handed out links to the wrong endpoint after every reinstall.

An instance record now carries optional public_host/public_port, set
from the globe button on its card or via
POST /api/servers/{id}/protocol/public-endpoint. The address flows into
AmneziaWG/WireGuard Endpoints, vless:// and tg:// links, connections
created for a user and self-service provisioning. Unset means exactly
what it meant before: the server address and the instance's listen port.

- telemt: the address is written into config.toml and reloaded without a
  restart; saving with the box down keeps the record and warns
- telemt: _patch_public_links matches the keys line by line -- the old
  pattern could span lines and weld public_host onto the line above
- xray: an explicit public port wins, but meta.json (synced from the
  live server.json) still beats the panel's remembered port
- reinstalling an instance keeps the address, like its exit link

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 README.md                        |   6 +
 app.py                           | 157 +++++++++++--
 connection_service.py            |   9 +-
 managers/awg_manager.py          |  18 +-
 managers/telemt_manager.py       |  51 ++++-
 managers/wireguard_manager.py    |  14 +-
 managers/xray_manager.py         |  10 +-
 templates/server.html            |  90 ++++++++
 tests/test_connection_service.py |  21 +-
 tests/test_public_endpoint.py    | 366 +++++++++++++++++++++++++++++++
 translations/en.json             |   9 +-
 translations/fa.json             |   9 +-
 translations/fr.json             |   9 +-
 translations/ru.json             |   9 +-
 translations/zh.json             |   9 +-
 15 files changed, 737 insertions(+), 50 deletions(-)
 create mode 100644 tests/test_public_endpoint.py

diff --git a/README.md b/README.md
index c198434..182ddf9 100644
--- a/README.md
+++ b/README.md
@@ -75,6 +75,7 @@ Configuration panel for system parameters and preferences:
     *   **Add / Edit / Delete / Reorder** server entries — drag-and-drop reorder updates `server_id` references in saved connections automatically.
     *   Every server carries a stable `uid` (assigned on add and backfilled for existing records at startup) for cross-server references that must survive reorder and delete.
     *   **Live ping indicator** next to each server name — non-blocking TCP-connect probe to the SSH port, runs on the asyncio loop in parallel for all servers.
+    *   **Public address per protocol instance**: by default a client dials the same address the panel opens SSH to. When an instance answers somewhere else — a second IP on the box, a port forward, a domain name — set its own **public address** (🌐 on the instance card) and every config, `vless://` and `tg://` link the panel issues points there instead. Telemt prints its own links, so the address is written into its `config.toml` and applied without a restart. The setting belongs to the instance, not to the install: reinstalling the protocol keeps it, and re-issuing a config for an existing client yields the new address with the same keys.
     *   **Clear server** wipes every Amnezia-related container, image and `/opt/amnezia` directory in a single sudo script — works for any current or future `amnezia-*` protocol.
     *   **Reboot** the server directly from the UI.
     *   Strictly concurrent protocol status polling — all supported protocols/services checked in parallel for immediate feedback.
@@ -285,6 +286,11 @@ curl -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/jso
 
 # Cheap reachability probe for monitoring
 curl -H "Authorization: Bearer $TOKEN" http://your-panel:5000/api/servers/0/ping
+
+# Publish an instance on another address (empty fields reset it to the server's own)
+curl -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
+  -d '{"protocol":"telemt","public_host":"203.0.113.9","public_port":"443"}' \
+  http://your-panel:5000/api/servers/0/protocol/public-endpoint
 ```
 
 ### Technology Stack
diff --git a/app.py b/app.py
index cfe9079..622afad 100644
--- a/app.py
+++ b/app.py
@@ -1175,6 +1175,50 @@ def _manager_call(manager, method, protocol, *args, **kwargs):
 AWG_PROTOCOLS = ('awg', 'awg2', 'awg3', 'awg_legacy')
 
 
+# A public host is an IP (v4, or v6 in the brackets an endpoint needs to stay
+# readable next to the port) or a DNS name. Anything else -- a scheme, a path,
+# a space, a bare IPv6 -- would be copied verbatim into client configs, where
+# it reads as a valid endpoint and simply never connects.
+PUBLIC_HOST_MAX = 253
+PUBLIC_HOST_RE = re.compile(r'^(\[[0-9A-Fa-f:.]+\]|[A-Za-z0-9][A-Za-z0-9._-]*)$')
+
+
+def normalize_public_host(value):
+    """Validated public host, or '' when the field is left empty."""
+    host = str(value or '').strip()
+    if not host:
+        return ''
+    if len(host) > PUBLIC_HOST_MAX or not PUBLIC_HOST_RE.match(host):
+        raise ValueError('Public host must be an IP address or a host name')
+    return host
+
+
+def normalize_public_port(value):
+    """Validated public port as a string, or '' when the field is left empty."""
+    port = str(value or '').strip()
+    if not port:
+        return ''
+    if not port.isdigit() or not 1 <= int(port) <= 65535:
+        raise ValueError('Public port must be a number between 1 and 65535')
+    return port
+
+
+def protocol_public_endpoint(server, protocol):
+    """The address clients must dial for one protocol instance: (host, port).
+
+    Both default to what the panel itself uses -- the server address it opens
+    SSH to, and the instance's own listen port (the returned port is None then,
+    so managers keep using it). An instance can live somewhere else: a second
+    IP on the same box, a port forward, a domain name. `public_host` and
+    `public_port` on the instance record carry that, and every config and link
+    handed to a client follows them.
+    """
+    info = (server.get('protocols') or {}).get(protocol) or {}
+    host = str(info.get('public_host') or '').strip() or server.get('host', '')
+    public_port = str(info.get('public_port') or '').strip() or None
+    return host, public_port
+
+
 def join_dns(dns1, dns2):
     """Join the two DNS fields into the `a, b` form used in configs."""
     parts = [str(value).strip() for value in (dns1, dns2) if value and str(value).strip()]
@@ -1556,6 +1600,7 @@ self_service_connections = ConnectionService(
     get_protocol_manager=get_protocol_manager,
     manager_call=_manager_call,
     generate_vpn_link=generate_vpn_link,
+    protocol_public_endpoint=protocol_public_endpoint,
 )
 
 
@@ -1775,12 +1820,13 @@ async def perform_mass_operations(delete_uids: List[str] = None, toggle_uids: Li
             for c_req in ops['create']:
                 proto_info = srv.get('protocols', {}).get(c_req['protocol'], {})
                 port = proto_info.get('port', '55424')
+                pub_host, pub_port = protocol_public_endpoint(srv, c_req['protocol'])
                 manager = get_protocol_manager(ssh, c_req['protocol'])
                 
                 if c_req['protocol'] == 'wireguard':
-                    res = await asyncio.to_thread(manager.add_client, c_req['name'], srv['host'])
+                    res = await asyncio.to_thread(manager.add_client, c_req['name'], pub_host, public_port=pub_port)
                 else:
-                    res = await asyncio.to_thread(_manager_call, manager, 'add_client', c_req['protocol'], c_req['name'], srv['host'], port)
+                    res = await asyncio.to_thread(_manager_call, manager, 'add_client', c_req['protocol'], c_req['name'], pub_host, port, public_port=pub_port)
                 
                 if res.get('client_id'):
                     new_conn = {
@@ -2168,6 +2214,12 @@ class RenameProtocolRequest(BaseModel):
     name: str = ''  # empty = reset to default
 
 
+class PublicEndpointRequest(BaseModel):
+    protocol: str = ''
+    public_host: str = ''  # empty = the server's own address
+    public_port: str = ''  # empty = the instance's listen port
+
+
 class AddConnectionRequest(BaseModel):
     protocol: str = 'awg'
     name: str = 'Connection'
@@ -3480,6 +3532,13 @@ async def api_install_protocol(request: Request, server_id: int, req: InstallPro
         install_base = protocol_base(install_protocol)
         # A reinstalled entry keeps its exit link and is re-linked below
         previous_link = None
+        # Where an instance is published is a property of the network, not
+        # of this install: reinstalling must not move clients back to the
+        # address the panel happens to manage the box through.
+        previous_record = (server.get('protocols') or {}).get(install_protocol) or {}
+        previous_public = {key: previous_record[key]
+                           for key in ('public_host', 'public_port')
+                           if previous_record.get(key)}
         # Reinstalling an instance is not the same as adding one: an instance a
         # user deliberately left unlinked must not be linked behind their back.
         reinstall = install_protocol in (server.get('protocols') or {})
@@ -3521,7 +3580,9 @@ async def api_install_protocol(request: Request, server_id: int, req: InstallPro
                 port=req.port,
                 tls_emulation=req.tls_emulation if req.tls_emulation is not None else True,
                 tls_domain=req.tls_domain,
-                max_connections=req.max_connections if req.max_connections is not None else 0
+                max_connections=req.max_connections if req.max_connections is not None else 0,
+                public_host=previous_public.get('public_host'),
+                public_port=previous_public.get('public_port'),
             )
         elif install_base == 'xray':
             install_args = ()
@@ -3620,6 +3681,7 @@ async def api_install_protocol(request: Request, server_id: int, req: InstallPro
         proto_record['container_name'] = protocol_container_name(install_protocol)
         if previous_link:
             proto_record['exit_link'] = previous_link
+        proto_record.update(previous_public)
         server['protocols'][install_protocol] = proto_record
         result['protocol'] = install_protocol
         result['base_protocol'] = install_base
@@ -4471,6 +4533,67 @@ def api_rename_protocol(request: Request, server_id: int, req: RenameProtocolReq
         return JSONResponse({'error': str(e)}, status_code=500)
 
 
+@app.post('/api/servers/{server_id}/protocol/public-endpoint', tags=["Protocols"])
+async def api_set_protocol_public_endpoint(request: Request, server_id: int, req: PublicEndpointRequest):
+    """Set or clear the address clients dial for one protocol instance.
+
+    Both fields are optional and empty means "as before": the server's own
+    address, the instance's listen port. Useful when an instance answers on a
+    second IP of the same box, behind a port forward, or under a domain name.
+    """
+    if not _check_admin(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    try:
+        data = load_data()
+        if server_id >= len(data['servers']):
+            return JSONResponse({'error': 'Server not found'}, status_code=404)
+        server = data['servers'][server_id]
+        proto = req.protocol.strip()
+        if proto not in server.get('protocols', {}):
+            return JSONResponse({'error': 'Protocol not found'}, status_code=404)
+        try:
+            host = normalize_public_host(req.public_host)
+            port = normalize_public_port(req.public_port)
+        except ValueError as e:
+            return JSONResponse({'error': str(e)}, status_code=400)
+
+        record = server['protocols'][proto]
+        for key, value in (('public_host', host), ('public_port', port)):
+            if value:
+                record[key] = value
+            else:
+                record.pop(key, None)
+        save_data(data)
+
+        # Telemt composes its own tg:// links from config.toml, so for that
+        # protocol the override reaches clients only after the file on the
+        # server carries it. The record is saved either way: a box that is down
+        # right now must not lose the setting, and the next install re-applies
+        # it.
+        warning = ''
+        if protocol_base(proto) == 'telemt':
+            ssh = None
+            try:
+                pub_host, pub_port = protocol_public_endpoint(server, proto)
+                ssh = await asyncio.to_thread(get_ssh, server)
+                await asyncio.to_thread(ssh.connect)
+                manager = get_protocol_manager(ssh, proto)
+                await asyncio.to_thread(
+                    manager.set_public_endpoint, pub_host, pub_port or record.get('port', '443'))
+            except Exception as e:
+                logger.warning(f"Could not apply the public endpoint to {proto}: {e}")
+                warning = str(e)
+            finally:
+                if ssh is not None:
+                    ssh.disconnect()
+
+        return {'status': 'success', 'protocol': proto,
+                'public_host': host, 'public_port': port, 'warning': warning}
+    except Exception as e:
+        logger.exception("Error setting protocol public endpoint")
+        return JSONResponse({'error': str(e)}, status_code=500)
+
+
 @app.post('/api/servers/{server_id}/wgeasy/import', tags=["Protocols"])
 def api_wgeasy_import(request: Request, server_id: int, req: WgEasyImportRequest):
     """Migrate clients from a wg-easy panel on this server into a panel-managed
@@ -4671,13 +4794,14 @@ def api_add_connection(request: Request, server_id: int, req: AddConnectionReque
         server = data['servers'][server_id]
         proto_info = server.get('protocols', {}).get(req.protocol, {})
         port = proto_info.get('port', '55424')
+        pub_host, pub_port = protocol_public_endpoint(server, req.protocol)
         ssh = get_ssh(server)
         ssh.connect()
         manager = get_protocol_manager(ssh, req.protocol)
         
         if protocol_base(req.protocol) == 'telemt':
             result = manager.add_client(
-                req.protocol, req.name, server['host'], port,
+                req.protocol, req.name, pub_host, pub_port or port,
                 telemt_quota=req.telemt_quota,
                 telemt_max_ips=req.telemt_max_ips,
                 telemt_expiry=req.telemt_expiry,
@@ -4686,9 +4810,9 @@ def api_add_connection(request: Request, server_id: int, req: AddConnectionReque
                 max_tcp_conns=req.telemt_max_conns
             )
         elif protocol_base(req.protocol) == 'wireguard':
-            result = manager.add_client(req.name, server['host'])
+            result = manager.add_client(req.name, pub_host, public_port=pub_port)
         else:
-            result = manager.add_client(req.protocol, req.name, server['host'], port)
+            result = manager.add_client(req.protocol, req.name, pub_host, port, public_port=pub_port)
         ssh.disconnect()
 
         if result.get('config'):
@@ -4888,10 +5012,11 @@ def api_get_connection_config(request: Request, server_id: int, req: ConnectionA
             return JSONResponse({'error': 'Client ID is required'}, status_code=400)
         proto_info = server.get('protocols', {}).get(req.protocol, {})
         port = proto_info.get('port', '55424')
+        pub_host, pub_port = protocol_public_endpoint(server, req.protocol)
         ssh = get_ssh(server)
         ssh.connect()
         manager = get_protocol_manager(ssh, req.protocol)
-        config = _manager_call(manager, 'get_client_config', req.protocol, req.client_id, server['host'], port)
+        config = _manager_call(manager, 'get_client_config', req.protocol, req.client_id, pub_host, port, public_port=pub_port)
         ssh.disconnect()
         return {'config': config, **config_payloads(config, server, req.protocol)}
     except Exception as e:
@@ -5030,13 +5155,14 @@ def api_add_user(request: Request, req: AddUserRequest):
                 server = data['servers'][req.server_id]
                 proto_info = server.get('protocols', {}).get(req.protocol, {})
                 port = proto_info.get('port', '55424')
+                pub_host, pub_port = protocol_public_endpoint(server, req.protocol)
                 conn_name = req.connection_name or f"{req.username}_vpn"
                 ssh = get_ssh(server)
                 ssh.connect()
                 manager = get_protocol_manager(ssh, req.protocol)
                 if protocol_base(req.protocol) == 'telemt':
                     conn_result = manager.add_client(
-                        req.protocol, conn_name, server['host'], port,
+                        req.protocol, conn_name, pub_host, pub_port or port,
                         telemt_quota=req.telemt_quota,
                         telemt_max_ips=req.telemt_max_ips,
                         telemt_expiry=req.telemt_expiry,
@@ -5045,7 +5171,7 @@ def api_add_user(request: Request, req: AddUserRequest):
                         max_tcp_conns=req.telemt_max_conns
                     )
                 else:
-                    conn_result = manager.add_client(req.protocol, conn_name, server['host'], port)
+                    conn_result = manager.add_client(req.protocol, conn_name, pub_host, port, public_port=pub_port)
                 ssh.disconnect()
 
                 if conn_result.get('client_id'):
@@ -5218,6 +5344,7 @@ async def api_add_user_connection(request: Request, user_id: str, req: AddUserCo
                 return JSONResponse({'error': _t('peer_already_linked', lang).replace('{}', owner_name)}, status_code=400)
         proto_info = server.get('protocols', {}).get(req.protocol, {})
         port = proto_info.get('port', '55424')
+        pub_host, pub_port = protocol_public_endpoint(server, req.protocol)
         ssh = await asyncio.to_thread(get_ssh, server)
         await asyncio.to_thread(ssh.connect)
         manager = get_protocol_manager(ssh, req.protocol)
@@ -5226,13 +5353,13 @@ async def api_add_user_connection(request: Request, user_id: str, req: AddUserCo
             # Use existing client
             target_client_id = req.client_id
             # Retrieve config for existing client
-            config = await asyncio.to_thread(_manager_call, manager, 'get_client_config', req.protocol, req.client_id, server['host'], port)
+            config = await asyncio.to_thread(_manager_call, manager, 'get_client_config', req.protocol, req.client_id, pub_host, port, public_port=pub_port)
             result = {'client_id': target_client_id, 'config': config}
         else:
             # Create new client
             if protocol_base(req.protocol) == 'telemt':
                 result = await asyncio.to_thread(
-                    manager.add_client, req.protocol, req.name, server['host'], port,
+                    manager.add_client, req.protocol, req.name, pub_host, pub_port or port,
                     telemt_quota=req.telemt_quota,
                     telemt_max_ips=req.telemt_max_ips,
                     telemt_expiry=req.telemt_expiry,
@@ -5241,7 +5368,7 @@ async def api_add_user_connection(request: Request, user_id: str, req: AddUserCo
                     max_tcp_conns=req.telemt_max_conns
                 )
             else:
-                result = await asyncio.to_thread(manager.add_client, req.protocol, req.name, server['host'], port)
+                result = await asyncio.to_thread(manager.add_client, req.protocol, req.name, pub_host, port, public_port=pub_port)
         
         await asyncio.to_thread(ssh.disconnect)
 
@@ -5505,11 +5632,12 @@ def api_share_config(token: str, connection_id: str, request: Request):
         server = data['servers'][sid]
         proto_info = server.get('protocols', {}).get(conn['protocol'], {})
         port = proto_info.get('port', '55424')
+        pub_host, pub_port = protocol_public_endpoint(server, conn['protocol'])
         ssh = get_ssh(server)
         ssh.connect()
         # Use appropriate manager for the protocol
         manager = get_protocol_manager(ssh, conn['protocol'])
-        config = _manager_call(manager, 'get_client_config', conn['protocol'], conn['client_id'], server['host'], port)
+        config = _manager_call(manager, 'get_client_config', conn['protocol'], conn['client_id'], pub_host, port, public_port=pub_port)
         ssh.disconnect()
         return {'config': config, **config_payloads(config, server, conn['protocol'])}
     except Exception as e:
@@ -5536,11 +5664,12 @@ def api_my_connection_config(request: Request, connection_id: str):
         server = data['servers'][sid]
         proto_info = server.get('protocols', {}).get(conn['protocol'], {})
         port = proto_info.get('port', '55424')
+        pub_host, pub_port = protocol_public_endpoint(server, conn['protocol'])
         ssh = get_ssh(server)
         ssh.connect()
         # Use appropriate manager for the protocol (fixes Telemt/Xray not working for users)
         manager = get_protocol_manager(ssh, conn['protocol'])
-        config = _manager_call(manager, 'get_client_config', conn['protocol'], conn['client_id'], server['host'], port)
+        config = _manager_call(manager, 'get_client_config', conn['protocol'], conn['client_id'], pub_host, port, public_port=pub_port)
         ssh.disconnect()
         return {'config': config, **config_payloads(config, server, conn['protocol'])}
     except Exception as e:
diff --git a/connection_service.py b/connection_service.py
index 254b088..3c90834 100644
--- a/connection_service.py
+++ b/connection_service.py
@@ -111,6 +111,7 @@ class ConnectionService:
         get_protocol_manager,
         manager_call,
         generate_vpn_link,
+        protocol_public_endpoint=None,
     ):
         self.load_data = load_data
         self.save_data = save_data
@@ -119,6 +120,10 @@ class ConnectionService:
         self.get_protocol_manager = get_protocol_manager
         self.manager_call = manager_call
         self.generate_vpn_link = generate_vpn_link
+        # Optional: without it a connection is issued for the server's own
+        # address and the instance's listen port, as it always was.
+        self.protocol_public_endpoint = protocol_public_endpoint or (
+            lambda server, protocol: (server.get('host', ''), None))
         self._provision_locks = defaultdict(asyncio.Lock)
         self._rate_events = defaultdict(list)
 
@@ -165,6 +170,7 @@ class ConnectionService:
                 self._validate_create_request(data, settings, user_id, server_id, protocol, clean_name, source)
                 server = dict(data['servers'][server_id])
                 port = server.get('protocols', {}).get(protocol, {}).get('port', '55424')
+                pub_host, pub_port = self.protocol_public_endpoint(server, protocol)
 
             # get_ssh() blocks on ensure_connected — keep it off the event loop.
             ssh = await asyncio.to_thread(self.get_ssh, server)
@@ -179,8 +185,9 @@ class ConnectionService:
                     'add_client',
                     protocol,
                     clean_name,
-                    server.get('host', ''),
+                    pub_host,
                     port,
+                    public_port=pub_port,
                 )
                 remote_client_id = result.get('client_id')
                 if not remote_client_id:
diff --git a/managers/awg_manager.py b/managers/awg_manager.py
index 51c685d..a1eae70 100644
--- a/managers/awg_manager.py
+++ b/managers/awg_manager.py
@@ -2577,10 +2577,14 @@ done < "$BW"
 
         return result
 
-    def add_client(self, protocol_type, client_name, server_host, port):
+    def add_client(self, protocol_type, client_name, server_host, port, public_port=None):
         """
         Add a new client/peer to the AWG config.
         Returns the client config as a string for the .conf file.
+
+        `public_port` is the port clients dial when it differs from the
+        listen port (instance published on another address, port forward);
+        the interface keeps listening on `port`.
         """
         container_name = self._container_name(protocol_type)
         wg_bin = self._wg_binary(protocol_type)
@@ -2698,7 +2702,7 @@ AllowedIPs = {allowed_ips}
 PublicKey = {server_pub_key}
 PresharedKey = {psk}
 AllowedIPs = {peer_allowed_ips}
-Endpoint = {server_host}:{port}
+Endpoint = {server_host}:{public_port or port}
 PersistentKeepalive = 25
 """
 
@@ -2709,8 +2713,12 @@ PersistentKeepalive = 25
             'config': client_config,
         }
 
-    def get_client_config(self, protocol_type, client_id, server_host, port):
-        """Reconstruct client config from stored data."""
+    def get_client_config(self, protocol_type, client_id, server_host, port, public_port=None):
+        """Reconstruct client config from stored data.
+
+        `public_port` overrides the Endpoint port the same way it does in
+        add_client, so a reissued config matches the one handed out first.
+        """
         clients_table = self._get_clients_table(protocol_type)
         client = None
         for c in clients_table:
@@ -2795,7 +2803,7 @@ PersistentKeepalive = 25
 PublicKey = {server_pub_key}
 PresharedKey = {psk}
 AllowedIPs = {peer_allowed_ips}
-Endpoint = {server_host}:{port}
+Endpoint = {server_host}:{public_port or port}
 PersistentKeepalive = 25
 """
         return config
diff --git a/managers/telemt_manager.py b/managers/telemt_manager.py
index 1afae84..8cf48f1 100644
--- a/managers/telemt_manager.py
+++ b/managers/telemt_manager.py
@@ -160,7 +160,8 @@ docker compose version
         if code != 0:
             raise RuntimeError(f"Failed to install docker compose plugin: {err or out}")
 
-    def install_protocol(self, protocol_type='telemt', port='443', tls_emulation=True, tls_domain="", max_connections=0):
+    def install_protocol(self, protocol_type='telemt', port='443', tls_emulation=True, tls_domain="",
+                         max_connections=0, public_host=None, public_port=None):
         results = []
         if not self.check_docker_installed():
             results.append("Installing Docker...")
@@ -192,12 +193,8 @@ docker compose version
             config_content = re.sub(r'max_connections\s*=\s*\d+', f'max_connections = {max_connections}', config_content)
 
         # Patch public_host and public_port for links
-        if "public_host =" in config_content or "# public_host =" in config_content:
-            config_content = re.sub(r'#?\s*public_host\s*=\s*".*?"', f'public_host = "{self.ssh.host}"', config_content)
-        else:
-            config_content = config_content.replace('[general.links]', f'[general.links]\npublic_host = "{self.ssh.host}"')
-            
-        config_content = re.sub(r'public_port\s*=\s*\d+', f'public_port = {port}', config_content)
+        config_content = self._patch_public_links(
+            config_content, public_host or self.ssh.host, public_port or port)
         
         # Remove default hello user
         config_content = re.sub(r'^hello\s*=\s*".*?"', '', config_content, flags=re.MULTILINE)
@@ -234,6 +231,42 @@ docker compose version
             "log": results
         }
 
+    def _patch_public_links(self, config_content, host, port):
+        """Point [general.links] at the address clients must dial.
+
+        Telemt composes its own tg:// links from these two keys, so an address
+        the panel knows about (a second IP on the box, a domain) reaches
+        clients only once it lands here. The keys are matched line by line: a
+        pattern allowed to span lines swallows the preceding newline and welds
+        two config lines together.
+        """
+        host_re = re.compile(r'^[ \t]*#?[ \t]*public_host[ \t]*=[ \t]*".*?"', re.MULTILINE)
+        port_re = re.compile(r'^[ \t]*#?[ \t]*public_port[ \t]*=[ \t]*\d+', re.MULTILINE)
+        if host_re.search(config_content):
+            config_content = host_re.sub(f'public_host = "{host}"', config_content, count=1)
+        else:
+            config_content = config_content.replace(
+                '[general.links]', f'[general.links]\npublic_host = "{host}"', 1)
+        if port_re.search(config_content):
+            config_content = port_re.sub(f'public_port = {port}', config_content, count=1)
+        else:
+            config_content = config_content.replace(
+                '[general.links]', f'[general.links]\npublic_port = {port}', 1)
+        return config_content
+
+    def set_public_endpoint(self, host, port):
+        """Re-point the links of a running instance, without reinstalling it.
+
+        Returns False when there is no config on the server to patch.
+        """
+        config_text = self._get_server_config()
+        if not config_text.strip():
+            return False
+        patched = self._patch_public_links(config_text, host, port)
+        if patched != config_text:
+            self.save_server_config(self.protocol, patched)
+        return True
+
     def _get_server_config(self):
         out, _, code = self.ssh.run_sudo_command(f"cat {self._config_path()}")
         if code != 0: return ""
@@ -601,7 +634,7 @@ docker compose version
         self.ssh.run_sudo_command(f"docker kill -s HUP {self.container_name} || docker restart {self.container_name}")
         return {'status': 'success', 'name': new_username, 'client_id': new_username}
 
-    def get_client_config(self, protocol_type, client_id, host='', port=''):
+    def get_client_config(self, protocol_type, client_id, host='', port='', public_port=None):
         resp = self._api_request("GET", f"/v1/users/{client_id}")
         if resp and resp.get('ok'):
             user = resp.get('data', {})
@@ -614,5 +647,5 @@ docker compose version
         c = next((c for c in clients if c['clientId'] == client_id), None)
         if c:
             secret = c.get('userData', {}).get('token', '')
-            if secret: return f"tg://proxy?server={host}&port={port}&secret={secret}"
+            if secret: return f"tg://proxy?server={host}&port={public_port or port}&secret={secret}"
         return "Not found"
diff --git a/managers/wireguard_manager.py b/managers/wireguard_manager.py
index 6d0621f..b104cda 100644
--- a/managers/wireguard_manager.py
+++ b/managers/wireguard_manager.py
@@ -783,10 +783,13 @@ tail -f /dev/null
 
         return clients_table
 
-    def add_client(self, client_name, server_host):
+    def add_client(self, client_name, server_host, public_port=None):
         """
         Add a new client/peer to the WireGuard config.
         Returns the client config string.
+
+        `public_port` is the port clients dial when it differs from the
+        listen port read from the server config.
         """
         # Generate client keys
         client_priv_key, client_pub_key = generate_wg_keypair()
@@ -845,7 +848,7 @@ MTU = {mtu}
 PublicKey = {server_pub_key}
 PresharedKey = {psk}
 AllowedIPs = 0.0.0.0/0, ::/0
-Endpoint = {server_host}:{port}
+Endpoint = {server_host}:{public_port or port}
 PersistentKeepalive = 25
 """
         return {
@@ -855,12 +858,13 @@ PersistentKeepalive = 25
             'config': client_config,
         }
 
-    def get_client_config(self, client_id, server_host, port=None):
+    def get_client_config(self, client_id, server_host, port=None, public_port=None):
         """Reconstruct client config from stored data.
 
         `port` is optional: when omitted (direct calls) the listen port is
         read from the server config; when passed by the panel (which already
-        knows the instance port) it is used for the Endpoint.
+        knows the instance port) it is used for the Endpoint. `public_port`
+        wins over both: it is the port clients must dial.
         """
         clients_table = self._get_clients_table()
         client = next((c for c in clients_table if c.get('clientId') == client_id), None)
@@ -897,7 +901,7 @@ MTU = {mtu}
 PublicKey = {server_pub_key}
 PresharedKey = {psk}
 AllowedIPs = 0.0.0.0/0, ::/0
-Endpoint = {server_host}:{port}
+Endpoint = {server_host}:{public_port or port}
 PersistentKeepalive = 25
 """
         return config
diff --git a/managers/xray_manager.py b/managers/xray_manager.py
index bbcd79b..da8cd58 100644
--- a/managers/xray_manager.py
+++ b/managers/xray_manager.py
@@ -678,7 +678,7 @@ ENTRYPOINT [ "dumb-init", "/opt/amnezia/start.sh" ]
 
         return clients_table
 
-    def get_client_config(self, protocol, client_id, server_host, port):
+    def get_client_config(self, protocol, client_id, server_host, port, public_port=None):
         clients = self._get_clients_table()
         client = next((c for c in clients if c['clientId'] == client_id), None)
         if not client: return None
@@ -701,14 +701,16 @@ ENTRYPOINT [ "dumb-init", "/opt/amnezia/start.sh" ]
         encoded_name = urllib.parse.quote(name)
         
         url = (
-            f"vless://{client_id}@{server_host}:{meta.get('port', port)}"
+            # meta.json is synced from the live server.json, so it beats the
+            # port the panel remembers; an explicit public port beats both.
+            f"vless://{client_id}@{server_host}:{public_port or meta.get('port', port)}"
             f"?type=tcp&security=reality&pbk={meta['public_key']}"
             f"&sni={sni}&fp=chrome&sid={meta['short_id']}"
             f"&spx=%2F&flow=xtls-rprx-vision#{encoded_name}"
         )
         return url
 
-    def add_client(self, protocol, client_name, server_host, port):
+    def add_client(self, protocol, client_name, server_host, port, public_port=None):
         client_id = str(uuid.uuid4())
         
         config = self._get_server_json()
@@ -750,7 +752,7 @@ ENTRYPOINT [ "dumb-init", "/opt/amnezia/start.sh" ]
 
         return {
             'client_id': client_id,
-            'config': self.get_client_config(protocol, client_id, server_host, port)
+            'config': self.get_client_config(protocol, client_id, server_host, port, public_port)
         }
 
     def toggle_client(self, protocol, client_id, enable):
diff --git a/templates/server.html b/templates/server.html
index 3b36875..8622937 100644
--- a/templates/server.html
+++ b/templates/server.html
@@ -644,6 +644,32 @@
     </div>
 </div>
 
+<!-- Public Endpoint Modal -->
+<div class="modal-backdrop" id="publicEndpointModal">
+    <div class="modal" style="max-width: 460px;">
+        <div class="modal-header">
+            <h2 class="modal-title">🌐 {{ _('public_endpoint_title') }}</h2>
+            <button class="modal-close" onclick="closeModal('publicEndpointModal')">&times;</button>
+        </div>
+        <div class="modal-body">
+            <div class="text-muted text-sm" style="margin-bottom: var(--space-md);" id="publicEndpointHint"></div>
+            <div class="form-group">
+                <label class="form-label">{{ _('public_endpoint_host') }}</label>
+                <input type="text" class="form-input" id="publicEndpointHost" maxlength="253" placeholder="{{ server.host }}">
+            </div>
+            <div class="form-group">
+                <label class="form-label">{{ _('public_endpoint_port') }}</label>
+                <input type="text" class="form-input" id="publicEndpointPort" maxlength="5" inputmode="numeric" placeholder="{{ _('public_endpoint_port_placeholder') }}">
+            </div>
+            <div class="text-muted text-sm">{{ _('public_endpoint_hint') }}</div>
+        </div>
+        <div class="modal-footer">
+            <button class="btn btn-secondary" onclick="closeModal('publicEndpointModal')">{{ _('cancel') }}</button>
+            <button class="btn btn-primary" onclick="savePublicEndpoint()" id="publicEndpointSaveBtn">{{ _('save') }}</button>
+        </div>
+    </div>
+</div>
+
 <!-- Rename Instance Modal -->
 <div class="modal-backdrop" id="renameProtoModal">
     <div class="modal" style="max-width: 420px;">
@@ -1270,6 +1296,13 @@
         {{ proto|tojson }}: {{ info.get('custom_name')|tojson }},
         {%- endfor %}
     };
+    // Per-instance public address. Absent = the instance is reached at the
+    // server's own address and its listen port.
+    const PUBLIC_ENDPOINTS = {
+        {%- for proto, info in (server.get('protocols') or {}).items() if info.get('public_host') or info.get('public_port') %}
+        {{ proto|tojson }}: { host: {{ (info.get('public_host') or '')|tojson }}, port: {{ (info.get('public_port') or '')|tojson }} },
+        {%- endfor %}
+    };
     const MARKETPLACE_APPS = [
         { proto: 'awg3', category: 'protocols', icon: '🛡', title: 'AmneziaWG 3.1', descKey: 'awg3_desc', badge: 'NEW' },
         { proto: 'awg2', category: 'protocols', icon: '✨', title: 'AmneziaWG 2.0', descKey: 'awg_desc' },
@@ -1302,6 +1335,9 @@
     let currentAwgProto = 'awg2';
 
     const AWG_PROTOCOLS = ['awg', 'awg2', 'awg3', 'awg_legacy'];
+    // Protocols that hand out a client config or link, and therefore have an
+    // address a client dials.
+    const ENDPOINT_PROTOCOLS = [...AWG_PROTOCOLS, 'wireguard', 'xray', 'telemt'];
     const SPECIAL_JUNK_KEYS = ['i1', 'i2', 'i3', 'i4', 'i5'];
     // Same value the desktop client ships as its default I1.
     const AWG_DEFAULT_I1 = '<r 2><b 0x858000010001000000000669636c6f756403636f6d0000010001c00c000100010000105a00044d583737>';
@@ -2016,9 +2052,14 @@
                     const exitBtn = AWG_PROTOCOLS.includes(protoBase(proto))
                         ? `<button class="btn btn-secondary btn-sm" onclick="openExitLinkModal('${proto}')" title="${_('exit_link_title')}">🚪${info.exit_link ? ' ' + escapeHtml(info.exit_link.exit_name || '') : ''}</button>`
                         : '';
+                    const ep = PUBLIC_ENDPOINTS[proto];
+                    const endpointBtn = ENDPOINT_PROTOCOLS.includes(protoBase(proto))
+                        ? `<button class="btn btn-secondary btn-sm" onclick="openPublicEndpointModal('${proto}')" title="${_('public_endpoint_title')}">🌐${ep ? ' ' + escapeHtml(publicEndpointLabel(ep)) : ''}</button>`
+                        : '';
                     ctrlEl.innerHTML = `
                         ${awgBtn}
                         ${exitBtn}
+                        ${endpointBtn}
                         <button class="btn btn-secondary btn-sm" onclick="showServerConfig('${proto}')" title="${_('server_config')}">${_('config_btn')}</button>
                         <button class="btn btn-danger btn-sm" onclick="toggleContainer('${proto}', true)" title="${_('stop_container_confirm').replace('{}', '')}">${_('stop_btn')}</button>
                     `;
@@ -2215,6 +2256,55 @@
         }
     }
 
+    // ---------- public endpoint of an instance ----------
+    let publicEndpointTarget = null;
+
+    function publicEndpointLabel(ep) {
+        if (!ep) return '';
+        return ep.port ? `${ep.host || SERVER_HOST}:${ep.port}` : (ep.host || '');
+    }
+
+    function openPublicEndpointModal(proto) {
+        publicEndpointTarget = proto;
+        const ep = PUBLIC_ENDPOINTS[proto] || { host: '', port: '' };
+        document.getElementById('publicEndpointHost').value = ep.host || '';
+        document.getElementById('publicEndpointPort').value = ep.port || '';
+        document.getElementById('publicEndpointHint').textContent =
+            _('public_endpoint_for').replace('{}', getProtoTitle(proto));
+        openModal('publicEndpointModal');
+    }
+
+    async function savePublicEndpoint() {
+        const proto = publicEndpointTarget;
+        if (!proto) return;
+        const host = document.getElementById('publicEndpointHost').value.trim();
+        const port = document.getElementById('publicEndpointPort').value.trim();
+        const btn = document.getElementById('publicEndpointSaveBtn');
+        btn.disabled = true;
+        try {
+            const res = await apiCall(`/api/servers/${SERVER_ID}/protocol/public-endpoint`, 'POST',
+                                      { protocol: proto, public_host: host, public_port: port });
+            if (host || port) {
+                PUBLIC_ENDPOINTS[proto] = { host, port };
+            } else {
+                delete PUBLIC_ENDPOINTS[proto];
+            }
+            closeModal('publicEndpointModal');
+            // The record is saved even when the protocol's own config could not
+            // be updated (server down); say so instead of a bare "saved".
+            if (res && res.warning) {
+                showToast(_('public_endpoint_not_applied') + ': ' + res.warning, 'error');
+            } else {
+                showToast(_('success') || 'Saved', 'success');
+            }
+            checkServer();
+        } catch (err) {
+            showToast((_('error') || 'Error') + ': ' + err.message, 'error');
+        } finally {
+            btn.disabled = false;
+        }
+    }
+
     // ---------- wg-easy import ----------
     let wgeasyClients = [];
 
diff --git a/tests/test_connection_service.py b/tests/test_connection_service.py
index 2751e8b..c522af7 100644
--- a/tests/test_connection_service.py
+++ b/tests/test_connection_service.py
@@ -20,8 +20,11 @@ class FakeManager:
     def __init__(self, result=None):
         self.result = result or {'client_id': 'client-1', 'config': 'client config'}
         self.removed = []
+        self.calls = []
 
-    def add_client(self, protocol, name, host, port):
+    def add_client(self, protocol, name, host, port, public_port=None):
+        self.calls.append({'protocol': protocol, 'name': name, 'host': host,
+                           'port': port, 'public_port': public_port})
         return dict(self.result)
 
     def remove_client(self, protocol, client_id):
@@ -29,7 +32,7 @@ class FakeManager:
 
 
 class FailingManager(FakeManager):
-    def add_client(self, protocol, name, host, port):
+    def add_client(self, protocol, name, host, port, public_port=None):
         raise RuntimeError('remote failed')
 
 
@@ -66,8 +69,11 @@ def base_data():
 
 
 class ConnectionServiceTest(unittest.IsolatedAsyncioTestCase):
-    def make_service(self, data=None, manager=None, save_raises=False):
+    def make_service(self, data=None, manager=None, save_raises=False,
+                     public_endpoint=None):
         state = copy.deepcopy(data or base_data())
+        public_endpoint = public_endpoint or (
+            lambda server, protocol: (server.get('host', ''), None))
         fake_manager = manager or FakeManager()
 
         def load_data():
@@ -86,8 +92,9 @@ class ConnectionServiceTest(unittest.IsolatedAsyncioTestCase):
             data_lock=asyncio.Lock(),
             get_ssh=lambda server: FakeSSH(),
             get_protocol_manager=lambda ssh, protocol: fake_manager,
-            manager_call=lambda manager, method, protocol, *args: getattr(manager, method)(protocol, *args),
+            manager_call=lambda manager, method, protocol, *args, **kwargs: getattr(manager, method)(protocol, *args, **kwargs),
             generate_vpn_link=lambda config: f'vpn://{config}',
+            protocol_public_endpoint=public_endpoint,
         )
         return service, state, fake_manager
 
@@ -350,9 +357,9 @@ class ConnectionServiceTest(unittest.IsolatedAsyncioTestCase):
             state.update(new_data)
 
         class MutatingManager(FakeManager):
-            def add_client(self, protocol, name, host, port):
+            def add_client(self, protocol, name, host, port, public_port=None):
                 state['users'][0]['enabled'] = False
-                return super().add_client(protocol, name, host, port)
+                return super().add_client(protocol, name, host, port, public_port)
 
         fake_manager = MutatingManager()
         service = ConnectionService(
@@ -361,7 +368,7 @@ class ConnectionServiceTest(unittest.IsolatedAsyncioTestCase):
             data_lock=asyncio.Lock(),
             get_ssh=lambda server: FakeSSH(),
             get_protocol_manager=lambda ssh, protocol: fake_manager,
-            manager_call=lambda manager, method, protocol, *args: getattr(manager, method)(protocol, *args),
+            manager_call=lambda manager, method, protocol, *args, **kwargs: getattr(manager, method)(protocol, *args, **kwargs),
             generate_vpn_link=lambda config: f'vpn://{config}',
         )
 
diff --git a/tests/test_public_endpoint.py b/tests/test_public_endpoint.py
new file mode 100644
index 0000000..14cdcf0
--- /dev/null
+++ b/tests/test_public_endpoint.py
@@ -0,0 +1,366 @@
+"""Per-instance public address: the endpoint a client actually dials.
+
+The panel handed out its own SSH address for every protocol on a server. A box
+can publish an instance somewhere else -- a second IP, a port forward, a domain
+name -- and the configs it issued were then unreachable; for telemt, which
+prints its own tg:// links, they were wrong even when the tunnel worked. The
+instance record now carries `public_host`/`public_port`, and these cover the
+lookup, the API around it, and the places the address reaches a client.
+"""
+
+import json
+import os
+import re
+import shutil
+import tempfile
+import unittest
+from unittest import mock
+
+from fastapi.testclient import TestClient
+
+import app as panel
+from managers.awg_manager import AWGManager
+from managers.telemt_manager import TelemtManager
+from managers.wireguard_manager import WireGuardManager
+from managers.xray_manager import XrayManager
+
+
+def server_with(protocols):
+    return {'name': 'Aeza', 'host': '198.51.100.1', 'ssh_port': 22, 'username': 'root',
+            'password': 'x', 'private_key': '', 'server_info': {}, 'uid': 'srv-uid',
+            'protocols': protocols}
+
+
+class EndpointResolutionTests(unittest.TestCase):
+    def test_without_an_override_the_panel_address_is_used(self):
+        server = server_with({'awg2': {'port': '55424'}})
+        self.assertEqual(panel.protocol_public_endpoint(server, 'awg2'), ('198.51.100.1', None))
+
+    def test_public_host_replaces_the_panel_address(self):
+        server = server_with({'telemt': {'port': '8443', 'public_host': '203.0.113.9'}})
+        self.assertEqual(panel.protocol_public_endpoint(server, 'telemt'), ('203.0.113.9', None))
+
+    def test_public_port_comes_back_for_the_managers(self):
+        server = server_with({'telemt': {'port': '8443', 'public_host': '203.0.113.9',
+                                         'public_port': '443'}})
+        self.assertEqual(panel.protocol_public_endpoint(server, 'telemt'), ('203.0.113.9', '443'))
+
+    def test_blank_and_missing_records_fall_back(self):
+        server = server_with({'awg2': {'port': '55424', 'public_host': '   ', 'public_port': ''}})
+        self.assertEqual(panel.protocol_public_endpoint(server, 'awg2'), ('198.51.100.1', None))
+        # an instance the panel has no record of at all
+        self.assertEqual(panel.protocol_public_endpoint(server, 'xray'), ('198.51.100.1', None))
+
+
+class ValidationTests(unittest.TestCase):
+    def test_addresses_and_names_pass(self):
+        for value in ('198.51.100.1', 'vpn.example.com', '[2a01:e5c0:7bc2::2]', 'a-b_c.example'):
+            self.assertEqual(panel.normalize_public_host(value), value)
+        self.assertEqual(panel.normalize_public_host('  198.51.100.1  '), '198.51.100.1')
+        self.assertEqual(panel.normalize_public_host(''), '')
+
+    def test_anything_that_would_silently_break_a_config_is_rejected(self):
+        for value in ('https://vpn.example.com', 'vpn.example.com/path', 'vpn example com',
+                      'host&other', 'a' * 254,
+                      # a bare IPv6 would read as host:port and never connect
+                      '2a01:e5c0:7bc2::2'):
+            with self.assertRaises(ValueError, msg=value):
+                panel.normalize_public_host(value)
+
+    def test_port_must_be_a_port(self):
+        self.assertEqual(panel.normalize_public_port(' 443 '), '443')
+        self.assertEqual(panel.normalize_public_port(''), '')
+        for value in ('0', '65536', '-1', '44a3', 'http'):
+            with self.assertRaises(ValueError, msg=value):
+                panel.normalize_public_port(value)
+
+
+class ClientConfigTests(unittest.TestCase):
+    """Every manager that builds an endpoint must honour the override."""
+
+    def wireguard(self):
+        mgr = WireGuardManager(ssh_manager=mock.Mock())
+        mgr._get_clients_table = lambda: [{'clientId': 'peer', 'userData': {
+            'clientPrivateKey': 'priv', 'clientIp': '10.8.0.6', 'psk': 'psk'}}]
+        mgr._get_server_public_key = lambda: 'serverpub'
+        mgr._get_server_psk = lambda: 'serverpsk'
+        mgr._get_listen_port = lambda: '51820'
+        mgr._get_dns = lambda ud=None: '1.1.1.1'
+        return mgr
+
+    def awg(self):
+        mgr = AWGManager(mock.Mock())
+        mgr._get_clients_table = lambda proto: [{'clientId': 'peer', 'userData': {
+            'clientPrivateKey': 'priv', 'clientIp': '10.8.1.6', 'psk': 'psk'}}]
+        mgr._get_client_ipv6 = lambda proto, ip: ''
+        mgr._get_server_public_key = lambda proto: 'serverpub'
+        mgr._get_server_psk = lambda proto: 'serverpsk'
+        mgr._get_awg_params_from_config = lambda proto: {}
+        mgr._get_dns = lambda proto, ud: '1.1.1.1'
+        mgr._get_mtu = lambda proto, ud: '1376'
+        return mgr
+
+    def xray(self):
+        mgr = XrayManager(mock.Mock())
+        mgr._get_clients_table = lambda: [{'clientId': 'uuid-1',
+                                          'userData': {'clientName': 'laptop'}}]
+        mgr._get_meta_json = lambda: {'port': 443, 'public_key': 'pbk', 'short_id': 'sid',
+                                      'site_name': 'yahoo.com'}
+        mgr._get_server_json = lambda: None
+        return mgr
+
+    def test_wireguard_endpoint_follows_the_public_port(self):
+        config = self.wireguard().get_client_config('peer', 'vpn.example.com', '51820',
+                                                    public_port='443')
+        self.assertIn('Endpoint = vpn.example.com:443', config)
+
+    def test_wireguard_keeps_the_listen_port_without_an_override(self):
+        config = self.wireguard().get_client_config('peer', 'vpn.example.com', '51820')
+        self.assertIn('Endpoint = vpn.example.com:51820', config)
+
+    def test_awg_endpoint_follows_the_public_port(self):
+        config = self.awg().get_client_config('awg2', 'peer', '203.0.113.9', '55424',
+                                              public_port='443')
+        self.assertIn('Endpoint = 203.0.113.9:443', config)
+
+    def test_awg_keeps_the_listen_port_without_an_override(self):
+        config = self.awg().get_client_config('awg2', 'peer', '198.51.100.1', '55424')
+        self.assertIn('Endpoint = 198.51.100.1:55424', config)
+
+    def test_xray_link_prefers_the_public_port_over_the_live_config(self):
+        link = self.xray().get_client_config('xray', 'uuid-1', 'vpn.example.com', '55424',
+                                             public_port='8443')
+        self.assertIn('@vpn.example.com:8443?', link)
+
+    def test_xray_link_without_an_override_still_trusts_meta(self):
+        # meta.json is synced from the live server.json; the panel's own record
+        # can be stale, so an unset override must not promote it.
+        link = self.xray().get_client_config('xray', 'uuid-1', 'vpn.example.com', '55424')
+        self.assertIn('@vpn.example.com:443?', link)
+
+
+TELEMT_CONFIG = """[general]
+port = 443
+
+[general.links]
+show = "*"
+# public_host = "proxy.example.com"  # Host (IP or domain) for tg:// links
+public_port = 443                  # Port for tg:// links
+
+[access.users]
+alice = "deadbeef"
+"""
+
+
+class TelemtLinkConfigTests(unittest.TestCase):
+    """Telemt prints its own links, so the address has to land in config.toml."""
+
+    def manager(self):
+        ssh = mock.Mock()
+        ssh.host = '198.51.100.1'
+        return TelemtManager(ssh)
+
+    def test_commented_host_is_activated_and_lines_stay_separate(self):
+        patched = self.manager()._patch_public_links(TELEMT_CONFIG, '203.0.113.9', '443')
+        self.assertIn('public_host = "203.0.113.9"', patched)
+        self.assertIn('public_port = 443', patched)
+        # A pattern allowed to span lines eats the newline before the key and
+        # welds it onto the previous line, quietly corrupting the config.
+        self.assertIn('show = "*"\n', patched)
+        self.assertEqual(len(TELEMT_CONFIG.splitlines()), len(patched.splitlines()))
+
+    def test_an_already_set_host_is_replaced_in_place(self):
+        once = self.manager()._patch_public_links(TELEMT_CONFIG, '203.0.113.9', '443')
+        twice = self.manager()._patch_public_links(once, '203.0.113.10', '8443')
+        self.assertIn('public_host = "203.0.113.10"', twice)
+        self.assertNotIn('203.0.113.9', twice)
+        self.assertEqual(twice.count('public_host'), 1)
+        self.assertEqual(len(once.splitlines()), len(twice.splitlines()))
+
+    def test_keys_are_added_when_the_section_has_neither(self):
+        bare = '[general.links]\nshow = "*"\n'
+        patched = self.manager()._patch_public_links(bare, 'vpn.example.com', '443')
+        self.assertIn('public_host = "vpn.example.com"', patched)
+        self.assertIn('public_port = 443', patched)
+
+    def test_set_public_endpoint_writes_and_reloads(self):
+        mgr = self.manager()
+        mgr._get_server_config = lambda: TELEMT_CONFIG
+        saved = []
+        mgr.save_server_config = lambda proto, content: saved.append(content)
+        self.assertTrue(mgr.set_public_endpoint('203.0.113.9', '443'))
+        self.assertEqual(len(saved), 1)
+        self.assertIn('public_host = "203.0.113.9"', saved[0])
+
+    def test_set_public_endpoint_reports_a_missing_config(self):
+        mgr = self.manager()
+        mgr._get_server_config = lambda: ''
+        mgr.save_server_config = lambda proto, content: self.fail('nothing to save')
+        self.assertFalse(mgr.set_public_endpoint('203.0.113.9', '443'))
+
+class PublicEndpointApiTests(unittest.TestCase):
+    """The API around the record, through the real app."""
+
+    def setUp(self):
+        self.tmp = tempfile.mkdtemp()
+        self._data_file = panel.DATA_FILE
+        panel.DATA_FILE = os.path.join(self.tmp, 'data.json')
+        with open(panel.DATA_FILE, 'w', encoding='utf-8') as f:
+            json.dump({'servers': [server_with({
+                'awg2': {'installed': True, 'port': '55424', 'base_protocol': 'awg2'},
+                'telemt': {'installed': True, 'port': '8443', 'base_protocol': 'telemt'},
+            })], 'users': [], 'user_connections': []}, f)
+        self._monitor_flag = panel._conn_monitor_started
+        panel._conn_monitor_started = True
+
+    def tearDown(self):
+        panel.DATA_FILE = self._data_file
+        panel._conn_monitor_started = self._monitor_flag
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def stored(self, protocol):
+        with open(panel.DATA_FILE, encoding='utf-8') as f:
+            return json.load(f)['servers'][0]['protocols'][protocol]
+
+    def client(self):
+        client = TestClient(panel.app)
+        client.__enter__()
+        self.addCleanup(client.__exit__, None, None, None)
+        login = client.post('/api/auth/login', json={'username': 'admin', 'password': 'admin'})
+        self.assertEqual(login.status_code, 200, login.text)
+        return client
+
+    def set_endpoint(self, client, **body):
+        return client.post('/api/servers/0/protocol/public-endpoint', json=body)
+
+    def test_set_and_clear_round_trip(self):
+        client = self.client()
+        res = self.set_endpoint(client, protocol='awg2', public_host='203.0.113.9',
+                                public_port='443')
+        self.assertEqual(res.status_code, 200, res.text)
+        self.assertEqual(res.json()['warning'], '')
+        self.assertEqual(self.stored('awg2')['public_host'], '203.0.113.9')
+        self.assertEqual(self.stored('awg2')['public_port'], '443')
+
+        # empty fields mean "back to the server address and the listen port":
+        # the keys go away rather than lingering as empty strings
+        res = self.set_endpoint(client, protocol='awg2', public_host='', public_port='')
+        self.assertEqual(res.status_code, 200, res.text)
+        self.assertNotIn('public_host', self.stored('awg2'))
+        self.assertNotIn('public_port', self.stored('awg2'))
+        self.assertEqual(self.stored('awg2')['port'], '55424', 'listen port must survive')
+
+    def test_bad_input_is_refused_before_it_reaches_a_config(self):
+        client = self.client()
+        res = self.set_endpoint(client, protocol='awg2', public_host='https://vpn.example.com')
+        self.assertEqual(res.status_code, 400, res.text)
+        res = self.set_endpoint(client, protocol='awg2', public_port='70000')
+        self.assertEqual(res.status_code, 400, res.text)
+        self.assertNotIn('public_host', self.stored('awg2'))
+
+    def test_unknown_protocol_and_server(self):
+        client = self.client()
+        self.assertEqual(self.set_endpoint(client, protocol='xray',
+                                           public_host='203.0.113.9').status_code, 404)
+        res = client.post('/api/servers/7/protocol/public-endpoint',
+                          json={'protocol': 'awg2', 'public_host': '203.0.113.9'})
+        self.assertEqual(res.status_code, 404)
+
+    def test_anonymous_callers_are_refused(self):
+        with TestClient(panel.app) as client:
+            res = client.post('/api/servers/0/protocol/public-endpoint',
+                              json={'protocol': 'awg2', 'public_host': '203.0.113.9'})
+            self.assertEqual(res.status_code, 403)
+
+    def test_telemt_override_is_pushed_into_the_running_config(self):
+        client = self.client()
+        manager = mock.Mock()
+        with mock.patch.object(panel, 'get_ssh', return_value=mock.Mock()), \
+             mock.patch.object(panel, 'get_protocol_manager', return_value=manager):
+            res = self.set_endpoint(client, protocol='telemt', public_host='203.0.113.9',
+                                    public_port='443')
+        self.assertEqual(res.status_code, 200, res.text)
+        manager.set_public_endpoint.assert_called_once_with('203.0.113.9', '443')
+
+    def test_telemt_falls_back_to_the_instance_port(self):
+        client = self.client()
+        manager = mock.Mock()
+        with mock.patch.object(panel, 'get_ssh', return_value=mock.Mock()), \
+             mock.patch.object(panel, 'get_protocol_manager', return_value=manager):
+            self.set_endpoint(client, protocol='telemt', public_host='203.0.113.9')
+        manager.set_public_endpoint.assert_called_once_with('203.0.113.9', '8443')
+
+    def test_an_unreachable_server_still_keeps_the_setting(self):
+        client = self.client()
+        with mock.patch.object(panel, 'get_ssh', side_effect=RuntimeError('host is down')):
+            res = self.set_endpoint(client, protocol='telemt', public_host='203.0.113.9')
+        self.assertEqual(res.status_code, 200, res.text)
+        self.assertIn('host is down', res.json()['warning'])
+        self.assertEqual(self.stored('telemt')['public_host'], '203.0.113.9')
+
+    def test_reinstall_keeps_the_public_address(self):
+        client = self.client()
+        manager = mock.Mock()
+        manager.install_protocol.return_value = {'status': 'success', 'awg_params': {}}
+        with mock.patch.object(panel, 'get_ssh', return_value=mock.Mock()), \
+             mock.patch.object(panel, 'get_protocol_manager', return_value=manager):
+            self.set_endpoint(client, protocol='awg2', public_host='203.0.113.9',
+                              public_port='443')
+            with mock.patch.object(panel, 'ensure_docker_installed', return_value=''), \
+                 mock.patch.object(panel, 'get_used_ports', return_value={}):
+                res = client.post('/api/servers/0/install',
+                                  json={'protocol': 'awg2', 'port': '55424'})
+        self.assertEqual(res.status_code, 200, res.text)
+        # The install rebuilds the record from scratch; where the instance is
+        # published is a property of the network, not of this install.
+        self.assertEqual(self.stored('awg2')['public_host'], '203.0.113.9')
+        self.assertEqual(self.stored('awg2')['public_port'], '443')
+
+    def test_telemt_reinstall_writes_the_override_into_the_fresh_config(self):
+        client = self.client()
+        manager = mock.Mock()
+        manager.install_protocol.return_value = {'status': 'success'}
+        with mock.patch.object(panel, 'get_ssh', return_value=mock.Mock()), \
+             mock.patch.object(panel, 'get_protocol_manager', return_value=manager):
+            self.set_endpoint(client, protocol='telemt', public_host='203.0.113.9',
+                              public_port='443')
+            with mock.patch.object(panel, 'ensure_docker_installed', return_value=''), \
+                 mock.patch.object(panel, 'get_used_ports', return_value={}):
+                res = client.post('/api/servers/0/install',
+                                  json={'protocol': 'telemt', 'port': '8443'})
+        self.assertEqual(res.status_code, 200, res.text)
+        kwargs = manager.install_protocol.call_args.kwargs
+        self.assertEqual(kwargs['public_host'], '203.0.113.9')
+        self.assertEqual(kwargs['public_port'], '443')
+
+    def test_issued_config_uses_the_override(self):
+        client = self.client()
+        manager = mock.Mock()
+        manager.add_client.return_value = {'client_id': 'peer', 'config': '[Interface]'}
+        with mock.patch.object(panel, 'get_ssh', return_value=mock.Mock()), \
+             mock.patch.object(panel, 'get_protocol_manager', return_value=manager):
+            self.set_endpoint(client, protocol='awg2', public_host='203.0.113.9',
+                              public_port='443')
+            res = client.post('/api/servers/0/connections/add',
+                              json={'protocol': 'awg2', 'name': 'laptop'})
+        self.assertEqual(res.status_code, 200, res.text)
+        args, kwargs = manager.add_client.call_args
+        self.assertEqual(args[2], '203.0.113.9', 'the client must dial the published address')
+        self.assertEqual(kwargs['public_port'], '443')
+
+    def test_server_page_carries_the_endpoints_and_the_modal(self):
+        client = self.client()
+        self.set_endpoint(client, protocol='awg2', public_host='203.0.113.9', public_port='443')
+        page = client.get('/server/0').text
+        self.assertIn('id="publicEndpointModal"', page)
+        self.assertIn('function openPublicEndpointModal', page)
+        endpoints = re.search(r'const PUBLIC_ENDPOINTS = (\{.*?\});', page, re.S).group(1)
+        self.assertIn('"awg2"', endpoints)
+        self.assertIn('203.0.113.9', endpoints)
+        self.assertIn('"443"', endpoints)
+        # a missing translation renders as the raw key
+        self.assertEqual(re.findall(r'>\s*public_endpoint_[a-z0-9_]+\s*<', page), [])
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/translations/en.json b/translations/en.json
index 2e34266..1bd9b2c 100644
--- a/translations/en.json
+++ b/translations/en.json
@@ -606,5 +606,12 @@
   "stop_peer_title": "Stop",
   "start_peer_title": "Enable",
   "ssh_cooldown_title": "SSH cooldown (sec)",
-  "ssh_cooldown_hint": "Initial delay before reconnecting to an unreachable server. Do not change if the server works fine."
+  "ssh_cooldown_hint": "Initial delay before reconnecting to an unreachable server. Do not change if the server works fine.",
+  "public_endpoint_title": "Public address",
+  "public_endpoint_for": "Address clients dial for {}",
+  "public_endpoint_host": "Host",
+  "public_endpoint_port": "Port",
+  "public_endpoint_port_placeholder": "instance port",
+  "public_endpoint_hint": "Leave empty to use the server address and the instance port. Fill this in when the instance answers on another IP of the same server, behind a port forward, or under a domain name.",
+  "public_endpoint_not_applied": "Saved, but not applied on the server"
 }
diff --git a/translations/fa.json b/translations/fa.json
index 30ce84e..114378c 100644
--- a/translations/fa.json
+++ b/translations/fa.json
@@ -573,5 +573,12 @@
   "stop_peer_title": "توقف",
   "start_peer_title": "فعال‌سازی",
   "ssh_cooldown_title": "SSH cooldown (ثانیه)",
-  "ssh_cooldown_hint": "تأخیر اولیه قبل از اتصال مجدد به سرور در دسترس‌نبوده. اگر سرور درست کار می‌کند، تغییر ندهید."
+  "ssh_cooldown_hint": "تأخیر اولیه قبل از اتصال مجدد به سرور در دسترس‌نبوده. اگر سرور درست کار می‌کند، تغییر ندهید.",
+  "public_endpoint_title": "نشانی عمومی",
+  "public_endpoint_for": "نشانی که کلاینت‌های {} به آن وصل می‌شوند",
+  "public_endpoint_host": "میزبان",
+  "public_endpoint_port": "درگاه",
+  "public_endpoint_port_placeholder": "درگاه نمونه",
+  "public_endpoint_hint": "خالی بگذارید تا نشانی سرور و درگاه همین نمونه استفاده شود. اگر این نمونه روی IP دیگری از همان سرور، پشت فوروارد درگاه یا با یک نام دامنه پاسخ می‌دهد، آن را پر کنید.",
+  "public_endpoint_not_applied": "ذخیره شد، اما روی سرور اعمال نشد"
 }
diff --git a/translations/fr.json b/translations/fr.json
index c9da6f6..a7300b2 100644
--- a/translations/fr.json
+++ b/translations/fr.json
@@ -573,5 +573,12 @@
   "stop_peer_title": "Arrêter",
   "start_peer_title": "Activer",
   "ssh_cooldown_title": "SSH cooldown (s)",
-  "ssh_cooldown_hint": "Délai initial avant reconnexion à un serveur injoignable. Ne modifiez pas si le serveur fonctionne correctement."
+  "ssh_cooldown_hint": "Délai initial avant reconnexion à un serveur injoignable. Ne modifiez pas si le serveur fonctionne correctement.",
+  "public_endpoint_title": "Adresse publique",
+  "public_endpoint_for": "Adresse utilisée par les clients de {}",
+  "public_endpoint_host": "Hôte",
+  "public_endpoint_port": "Port",
+  "public_endpoint_port_placeholder": "port de l'instance",
+  "public_endpoint_hint": "Laissez vide pour utiliser l'adresse du serveur et le port de l'instance. Renseignez ces champs si l'instance répond sur une autre IP du même serveur, derrière une redirection de port ou sous un nom de domaine.",
+  "public_endpoint_not_applied": "Enregistré, mais non appliqué sur le serveur"
 }
diff --git a/translations/ru.json b/translations/ru.json
index 622d13e..5a36cba 100644
--- a/translations/ru.json
+++ b/translations/ru.json
@@ -606,5 +606,12 @@
   "stop_peer_title": "Остановить",
   "start_peer_title": "Включить",
   "ssh_cooldown_title": "SSH cooldown (сек)",
-  "ssh_cooldown_hint": "Начальная пауза перед повторным подключением к недоступному серверу. Не меняйте, если сервер работает корректно."
+  "ssh_cooldown_hint": "Начальная пауза перед повторным подключением к недоступному серверу. Не меняйте, если сервер работает корректно.",
+  "public_endpoint_title": "Публичный адрес",
+  "public_endpoint_for": "Адрес, на который подключаются клиенты {}",
+  "public_endpoint_host": "Хост",
+  "public_endpoint_port": "Порт",
+  "public_endpoint_port_placeholder": "порт экземпляра",
+  "public_endpoint_hint": "Оставьте пустым — будут использованы адрес сервера и порт экземпляра. Заполните, если экземпляр отвечает на другом IP того же сервера, через проброс порта или по доменному имени.",
+  "public_endpoint_not_applied": "Сохранено, но не применено на сервере"
 }
diff --git a/translations/zh.json b/translations/zh.json
index 92ca252..11b6db3 100644
--- a/translations/zh.json
+++ b/translations/zh.json
@@ -573,5 +573,12 @@
   "stop_peer_title": "停止",
   "start_peer_title": "启用",
   "ssh_cooldown_title": "SSH 冷却时间(秒)",
-  "ssh_cooldown_hint": "重新连接不可达服务器前的初始延迟。如果服务器工作正常,请勿更改。"
+  "ssh_cooldown_hint": "重新连接不可达服务器前的初始延迟。如果服务器工作正常,请勿更改。",
+  "public_endpoint_title": "公网地址",
+  "public_endpoint_for": "{} 的客户端连接地址",
+  "public_endpoint_host": "主机",
+  "public_endpoint_port": "端口",
+  "public_endpoint_port_placeholder": "实例端口",
+  "public_endpoint_hint": "留空则使用服务器地址和实例端口。当实例通过同一服务器的另一个 IP、端口转发或域名对外提供服务时填写。",
+  "public_endpoint_not_applied": "已保存，但未在服务器上生效"
 }