Release Notes
Highlights
- IPv6-disabled hosts get a clean refusal instead of a crash-dump (#242). Connecting a WireGuard profile whose
Address line declares an IPv6 entry used to fail mid-way inside wg-quick with a raw RTNETLINK answers: Operation not supported error and a retry loop. Both the TUI and CLI now refuse pre-flight with an actionable message: re-enable IPv6 via sysctl (or remove ipv6.disable=1 from the kernel cmdline), or drop the IPv6 entry from the profile. The profile is never rewritten silently. (#247)
- CLI lifecycle hardening (#249).
vortix up is now truly idempotent, live tunnels are no longer flagged as "possible orphans" on every down, and concurrent up/down/reconnect invocations from multiple terminals serialize instead of racing.
Fixed
vortix up is now truly idempotent. Re-running up for an already-connected profile prints Already connected and exits 0 instead of re-spawning the tunnel. Previously a second up of an OpenVPN profile spawned a duplicate daemon whose --writepid clobbered the first's pidfile, leaving the original daemon untracked. (#249)- No more spurious orphan warnings for live tunnels. The startup orphan scan now excludes PIDs recorded in profile pidfiles (
run/<name>.pid), so vortix down / status no longer flags the active session's own openvpn daemon as a "possible orphan from a previous session." (#249)
- Concurrent
up/down/reconnect invocations are serialized via a flock lifecycle lock in the config dir. Two terminals racing the same mutation now queue instead of interleaving; the second prints a one-line "waiting…" note. (#249)
- OpenVPN double-spawn guard at the tunnel layer:
up() refuses when the profile's pidfile records a live daemon (covers the mid-negotiation window the scanner can't see). (#249)
- WireGuard connect on a Linux host with IPv6 disabled no longer fails mid-way inside
wg-quick (see Highlights). Detection covers both disable mechanisms: sysctl disable_ipv6=1 and the ipv6.disable=1 boot param, verified against real kernels in both states. (#242, #247)
- Daemon socket now binds inside the Tokio runtime (#233).
Security
- Bumped
crossbeam-epoch 0.9.18 → 0.9.20 for RUSTSEC-2026-0204 (invalid pointer dereference in fmt::Pointer; reached via a build-tooling dependency chain, not vortix's runtime path).
Changed
- README now documents the kill-switch reboot boundary: firewall rules do not survive an OS reboot, so
vpn-only is unenforced between boot and the next vortix launch. Persistence across reboot is tracked in #250. (#249)
- The flip-panel widget now ships as the extracted
ratatui-flip-panel crate, consumed as a dependency. (#232)
Documentation
- README overhaul: install matrix, named competitor comparison, security model, contributing section. (#230)
- Refreshed demo GIFs (hero + 4 scenario clips) and README cleanup. (#236)
- X/Twitter handle badge. (#244)
Install vortix 0.4.3
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/Harry-kp/vortix/releases/download/v0.4.3/vortix-installer.sh | sh
Install prebuilt binaries via Homebrew
brew install Harry-kp/tap/vortix
Install prebuilt binaries into your npm project
npm install @harry-kp/vortix@0.4.3
Download vortix 0.4.3
