CayVPN 2.0.1

CayVPN 2.0.1

This patch fixes the public bootstrap on Ubuntu 24.04. Reading the operating
system identity previously replaced CayVPN's release version, causing 2.0.0
to reject its correctly signed archive before running the installer. The
platform check now runs in an isolated shell environment.

Four process-level regression checks cover the real bootstrap flow: a valid
signed archive on Ubuntu, mutable release rejection, invalid signature
rejection even when transport digests match, and unsupported OS rejection.

Use 2.0.1 for new installations. Version 2.0.0 is superseded; its immutable
release remains available for traceability. No keys or server configuration
need recovery from the failed 2.0.0 bootstrap because installation never began.

curl -fsSL https://raw.githubusercontent.com/caynetic/cayvpn/v2.0.1/bootstrap.sh | sudo bash

The 2.0 release notes describe the management panel, routing,
DNS and IPv6 controls, signing, backup and recovery, installation requirements,
and acceptance limits. Dependencies and VPN runtime behavior are unchanged
by this patch. Use a clean dedicated Ubuntu 24.04 x86_64 or ARM64 server;
CayVPN 1.x and private acceptance builds are not upgraded in place.

CayVPN 2.0 features and compatibility

• A private web panel reached through a separate, individually revocable owner
  WireGuard connection. Optional owner login supports access from an ordinary
  CayVPN connection or explicitly enabled public HTTPS.
• WireGuard and AmneziaWG client profiles, with guided setup and editable DNS
  and IPv6 policies. DNS changes produce an updated profile; keys, addresses,
  and the selected Location are preserved.
• Direct server IP, attached additional IP, imported provider tunnel, and
  SOCKS5 Locations. Each client has its own routing policy. Approved backup
  groups can fail over automatically; returning to a recovered primary is
  an explicit owner action.
• Standard or ad-blocking DNS follows the selected Location. IPv6 capability
  is verified separately. Smart mode blocks unavailable IPv6 while retaining
  IPv4; Require IPv6 blocks the connection when dual-stack service is lost.
• Signed, immutable release downloads with pinned offline Python and native
  components; owner-approved updates, rollback, encrypted backups and SSH
  recovery. An upstream failure must not silently send traffic through the
  server's ordinary connection.

Installation and compatibility

Use a clean, dedicated Ubuntu 24.04 x86_64 or ARM64 server with SSH access,
a public IPv4 address, and at least 5 GiB free disk space. Configure a usable
public IPv6 address with your host if you want dual-stack Internet access.
The installer checks resources and refuses conflicting VPN, firewall or
service configuration before installation. Plan capacity for your actual load;
the installation minimum is not a throughput or client-count guarantee.

curl -fsSL https://raw.githubusercontent.com/caynetic/cayvpn/v2.0.1/bootstrap.sh | sudo bash

Keep the downloaded owner kit and your recovery passphrase private. Start with
its admin profile and certificate, then create ordinary client profiles in the
panel. Use a compatible WireGuard or Amnezia client application on your device.

CayVPN 1.x cannot be upgraded in place. Keep its server and configuration
available, install 2.0 on a clean server, and create and import new profiles.
Internal 2.0.x acceptance builds used a disposable trust key and are not an
upgrade source for this public release.

Verification scope

The release candidate passed 329 automated tests on native Ubuntu ARM64 and
x86_64. Real WireGuard and AmneziaWG traffic on the dedicated test servers
covered standard/ad-blocking DNS, Smart/Require IPv6, existing-client changes,
profile reimport, route and backup-group changes, upstream failure, reconnection,
revocation, and second-client isolation. Earlier native acceptance exercised
signed installation, upgrade, rollback, reboot recovery, encrypted restore and
uninstall, including injected failures.

These checks do not certify every provider, device, or workload. Controlled
same-server upstream fixtures establish routing behavior; they are not proof
for an independent commercial provider. Additional IP routing, provider UDP,
and provider IPv6 depend on the supplied configuration and live capability
checks. Physical-device import, sleep/wake, Wi-Fi/mobile transitions, optional
passkey compatibility, and sustained-load limits need acceptance in the owner's
environment. There is no independent security-audit certification.

IPv6-only servers, NAT64, automatic provider provisioning, and migration from
1.x are not supported. SOCKS5 UDP stays blocked until its end-to-end relay checks
pass. Remote public administration starts disabled.

Privacy and support

CayVPN requires no Caynetic account or hosted relay and sends no application
telemetry. Configuration, operational records, counters and recovery data stay
on your server. Your host, chosen DNS/upstream services, and external update or
capability-check endpoints have their own policies. Self-hosting does not make
the server or its public address anonymous.

Use GitHub issues for community
support without attaching private keys, profiles, owner kits or passphrases.
Optional project support never unlocks
features or gates installation.

Public release verification — September 14, 2026

The exact published installation command completed on a fresh native Ubuntu
24.04 ARM64 virtual machine and in an isolated Ubuntu 24.04 x86_64 environment
on the DigitalOcean test VPS. Both installations verified the production
signature and exact signed inventory. Real WireGuard and AmneziaWG connections
passed standard and ad-blocking DNS, IPv4 Internet access, private admin
access isolation, reconnect, revocation, and test-client cleanup.

The x64 fixture shares the test VPS kernel and uses an isolated IPv4 NAT
network; its required IPv6 forwarding was configured from outside the
container's read-only kernel view. The ARM64 fixture uses a local NAT carrier.
These are controlled server-side checks, not physical-device or independent
commercial-provider acceptance. Earlier dual-stack and routing acceptance is
described above. All 329 automated tests passed on each native architecture.