Self-hosted node
A node is Aquilon running next to your Squad server instead of reaching it across the internet. It is the same binary the cloud runs, started in node mode. You do not need one — Aquilon works over RCON and SFTP without it — but a node buys three things:
- No inbound exposure. The node dials out to Aquilon over TLS on port 443. Your RCON port never has to accept a connection from outside, and your RCON password never leaves your box.
- Live log tailing instead of SFTP polling. Events arrive as they are written.
- The tactical tier. Positions, vehicles, deployables, capture zones and kits, read from the running Squad process — a live map, heatmaps and positional automod that no RCON command can provide.
A node replaces SFTP entirely: it tails the log locally and edits ServerConfig/*.cfg on disk.
Requirements
| Transport only | Tactical | |
|---|---|---|
| OS | Linux, or anything that runs the container | Linux |
| Placement | anywhere that reaches RCON and the log file | the same machine as the Squad server |
| Outbound | TCP 443 to Aquilon | same |
| Game process | — | same user as the server, or CAP_SYS_PTRACE |
The tactical tier reads the game process's own memory, read-only, without pausing it. If you cannot run software on the same machine as your Squad server, it cannot work for you at any price; plan on the cloud tier.
Install
- In the app, under the server's Setup → Self-hosted node, add a node and pick the servers it fronts. You get a one-time bundle: a credentials seed and a generated
node.toml. The seed is shown once. - Put both files on the box and fill in what the cloud deliberately does not know — the RCON password and the log path:
mkdir -p /etc/aquilon
$EDITOR /etc/aquilon/node.toml # the generated config
$EDITOR /etc/aquilon/node.creds # the seed
chmod 600 /etc/aquilon/node.creds
- Run the installer:
curl -fsSL https://aquilon.cc/install.sh | sudo sh # static binary + systemd, updates nightly
curl -fsSL https://aquilon.cc/install.sh | sudo sh -s -- --docker # or as a container
The installer verifies every download against its published SHA-256 and refuses to run without your node.toml and node.creds.
Two builds, and the difference is real
There are two node builds. The standard one is compiled without the memory-reading agent: it cannot read your game process even if you ask it to, and you can verify that yourself with strings. The tactical build contains the agent and is what the live map needs. Which one a box gets was decided when you enrolled the node and travels in node.toml; the installer never installs a memory reader you did not ask for.
The tactical tier is on Pro and Network plans. Pricing →
Revoking a node
Delete the node in the app and its key stops working at the next reconnect; its servers fall back to cloud polling. Rotate the key instead when you only lost the credentials file.