winget install --id=mmalmi.nostr-vpn -e nostr-vpn is a Rust workspace for a Tailscale-style mesh VPN control plane built on Nostr signaling and userspace WireGuard. It includes the nvpn CLI plus a Tauri/Svelte app codebase that targets desktop and mobile platforms.
> Canonical repository: git.iris.to (htree://npub1xdhnr9mrv47kkrn95k6cwecearydeh8e895990n3acntwvmgk2dsdeeycm/nostr-vpn). GitHub is a mirror.
nostr-vpn is a Tailscale-style private mesh VPN built around a FIPS-backed data plane. It includes the nvpn CLI/daemon, a shared native app core, and native shells for desktop and mobile platforms.
cargo install nvpnRelease artifacts currently cover native Apple Silicon macOS, Linux x64, Windows x64, Android arm64, and headless CLI archives for Apple Silicon macOS, Windows x64, Linux x86_64, and Linux arm64. Intel macOS is source-only for now.
cargo install nvpn --force
nvpn init
MY_NPUB=''
nvpn set --participant "$MY_NPUB"
nvpn create-invite
nvpn start --daemon --connect
Use the printed invite on another device; do not paste the example placeholder:
INVITE=''
nvpn init
nvpn import-invite "$INVITE"
nvpn start --daemon --connect
For the background daemon flow used by desktop apps:
nvpn start --daemon --connect
nvpn status
nvpn stop
For persistent startup:
sudo nvpn service install
nvpn service status
On Windows, run nvpn service install from an elevated shell instead of using sudo.
The native apps share the Rust app-core state/action contract and use platform shells for macOS, Linux, Windows, Android, and iOS.
just build
just run
Use just run-macos or just run-linux when you want a specific desktop target.
| Platform | Status |
|---|---|
| Apple Silicon macOS | Native SwiftUI/AppKit app, CLI tarball, signed/notarized release artifacts when credentials are configured |
| Linux x64 | Native GTK/libadwaita app, .deb, CLI tarballs, Docker e2e coverage |
| Windows x64 | Native WPF app, installer, CLI zip, WinTun tunnel path |
| Android arm64 | Native app-core UI, signed APK/AAB artifacts when signing is configured, VPN runtime still being hardened |
| iOS | Native SwiftUI app and NetworkExtension target build from source and simulator; public TestFlight access is pending |
| Umbrel / StartOS | Web control panels and service packages |
| Intel macOS | Source-only |
This section is intentionally compact and command-oriented. Keep user-facing product detail above; keep agent/operator reference material here.
nvpn init creates the config and keys automatically. By default, config lives in the OS app config directory:
~/.config/nvpn/config.toml~/Library/Application Support/nvpn/config.toml./nvpn.tomlThe config contains global app settings, Nostr relay/identity settings, NAT settings, node settings, and a [[networks]] list. Each network has its own stable network_id; only the active network participates in the live runtime.
Normal Rust gate:
cargo fmt --check
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace
Release gate before version bumps and tags:
just release-gate
Useful focused checks:
pnpm --dir web/control-panel check
( cd linux && cargo check )
dotnet build windows\NostrVpn.Windows\NostrVpn.Windows.csproj -p:EnableWindowsTargeting=true
Run the Windows build on the configured Windows dev VM when local dotnet is unavailable.
docker compose -f umbrel/docker-compose.local.yml up --build
just e2e-umbrel-web
Focused security regression kit:
just security-regressions
Docker e2e and desktop updater scripts live under scripts. The most common entrypoints are scripts/e2e-docker.sh, scripts/e2e-fips-routed-udp-docker.sh, scripts/e2e-fips-nat-safe-mtu-docker.sh, scripts/e2e-wireguard-exit-docker.sh, and scripts/e2e-update-desktop.sh.
CHANGELOG.md from ## Unreleased to ## X.Y.Z - YYYY-MM-DD.[workspace.package].version in Cargo.toml.node scripts/sync-versions.mjs and verify with node scripts/sync-versions.mjs --check.just release-gate.git tag vX.Y.Z, push the tag to github, and push master to both github and htree origin..github/workflows/release.yml.For local artifact staging, use:
cp .env.release.example .env.release.local
$EDITOR .env.release.local
just release-publish
crates/nostr-vpn-cli: nvpn CLI and daemon implementationcrates/nostr-vpn-core: config, FIPS control state, diagnostics, MagicDNS, and NAT helperscrates/nostr-vpn-app-core: native app state/action contract and UniFFI bridgemacos, linux, windows, android, ios: native platform shellsumbrel, startos: packaged service/web-control-panel targetsscripts: build, release, Docker e2e, and desktop updater entrypoints