winget install --id=mmalmi.nostr-vpn -e nostr-vpn is a Rust workspace for a Tailscale-style mesh VPN control plane built on Nostr signaling and userspace WireGuard. It includes the nvpn CLI plus a Tauri/Svelte app codebase that targets desktop and mobile platforms.
nostr-vpn is a Tailscale-style private mesh VPN with a data plane powered by our independently evolved FIPS implementation, based on the original FIPS project. It also includes an experimental marketplace for byte-metered public exit nodes paid in Bitcoin through Cashu.
Nostr identities and signed rosters control enrollment; peers connect directly when possible and route through FIPS neighbors when direct UDP is unavailable. MagicDNS, subnet routes, exit nodes, and WireGuard upstream egress are built in. The project includes the nvpn CLI and daemon plus native apps for macOS, Linux, Windows, Android, and iOS.
The fork is optimized for high-rate VPN traffic. In comparable direct-path benchmarks it delivers roughly three times the original implementation's throughput by keeping packet ownership, buffers, and session state together, batching I/O and cryptography, reusing packet storage, and avoiding packet-by-packet queue hops, allocations, copies, and repeated lookups. It preserves the FIPS protocol surface.
cargo install nvpn.s9pk packages in the releases above, plus a multi-architecture Umbrel image and app bundleDesktop apps target Apple Silicon macOS and x64 Linux/Windows; mobile builds target arm64, and CLI archives also cover Linux arm64. StartOS and Umbrel support x86_64/amd64 and arm64. Intel macOS is source-only.
On Debian or Ubuntu, building the CLI with Cargo requires pkg-config and
libdbus-1-dev (sudo apt install pkg-config libdbus-1-dev). The prebuilt CLI
archives do not require these development packages.
Create a network on the first device:
nvpn init
DEVICE_ID=''
nvpn set --device "$DEVICE_ID"
nvpn start --daemon --connect
On another device, start its daemon, generate a signed join request, and scan or paste the request into an admin's Nostr VPN app:
nvpn init
nvpn start --daemon --connect
nvpn join-request
The daemon lifecycle is:
nvpn start --daemon --connect
nvpn status
nvpn stop
For startup at boot, run sudo nvpn service install; on Windows, run nvpn service install from an elevated shell. Check it with nvpn service status.
Buy or sell VPN bandwidth for Bitcoin. Providers can sell their own internet connection or a WireGuard VPN uplink. Providers advertise per-byte prices over Nostr; buyers fund Cashu Spilman channels and sign payment updates as they use bandwidth. Uploads count as sent; UDP replies and acknowledged TCP downloads count too, without double-billing TCP retransmissions. Choose a provider manually or automatically using connection quality, trusted ratings, and price.
DNS is encrypted by default, but exits still see destination IPs and unencrypted traffic. Use HTTPS for sensitive data. See payment and privacy details.
just build
just run
just verify-fast
Use just run-macos or just run-linux for a specific desktop target. See verification tiers for broader native, integration, and release checks.
The canonical repository is git.iris.to (htree://npub1xdhnr9mrv47kkrn95k6cwecearydeh8e895990n3acntwvmgk2dsdeeycm/nostr-vpn); GitHub is a mirror.