Skip to content

NexaPipe v0.1.0

Choose a tag to compare

View all tags
@open-nexa open-nexa released this 25 Sep 16:27
· 340 commits to main since this release
v0.1.0
81f6c69
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

NexaPipe exposes HTTP, HTTPS, WebSocket, TCP and UDP services that live behind NAT through a single iroh/QUIC endpoint — without terminating TLS, without a control plane, and without a server to rent.

Server (nexapipe)

  • L7 reverse proxy over iroh/QUIC: routing by Host and path prefix, round-robin / random load balancing, WebSocket upgrade, backend health checks.
  • TLS passthrough: matched by SNI and copied through as bytes — the proxy holds no certificate and never sees a plaintext byte of an https:// request. Your backend keeps the certificates.
  • L4 tunnel for TCP and UDP: raw TCP flows and framed UDP flows over QUIC bi-streams, via a dependency-free wire format (nexapipe-proto).
  • NAT traversal without infrastructure: clients hole-punch straight to your endpoint, with relay fallback (default / pinned / disabled / custom).
  • Live configuration: routes and auth clients re-read every 5 seconds, applied without a restart; an invalid edit is ignored, never taken live.
  • Docker support via the bundled docker-compose.yaml.

Client library (nexapipe-client)

The part no hosted tunnel can copy — embed it in your own app:

  • Rust rlib with connection pooling, domain-to-node routing and load balancing.
  • Local HTTP proxy and a smoltcp-based TUN proxy with one virtual IP per domain (which is what makes UDP possible).
  • cdylib for Android JNI and UniFFI bindings for Swift / Kotlin / Python.

Client apps

  • Android (Kotlin + Compose): VpnService TUN with DNS hijack and TCP/UDP redirect, QR-code invite and 2FA import.
  • Desktop (Tauri 2 + Vue 3): local HTTP proxy or system TUN, with signed auto-updates on Windows, macOS and Linux.

Security

  • TOTP 2FA handshake on every client connection; the response signature is verified before the code comparison, and any standard authenticator app works via otpauth:// QR codes.
  • One-time enrollment invites: the first device to connect burns the token and receives a freshly issued secret, so a copied link stops being a credential the moment it is used.
  • Query strings redacted in access logs by default; tokens in ?token=… never land on disk.
  • Hardened defaults: the direct listener is unbound unless configured, non-loopback binds require expose = true, per-peer connection caps, and the config holding 2FA secrets must be owner-only readable.

Downloads

All attached below, with a SHA256SUMS.txt covering every asset:

  • Server — 8 targets: Linux (glibc + musl), macOS and Windows, x86_64 + aarch64.
  • Desktop — NSIS (Windows x64/arm64), DMG (macOS Intel/Apple Silicon), deb / rpm / AppImage (Linux x64/arm64), plus latest.json for the updater.
  • Android — signed nexapipe-0.1.0-arm64-v8a.apk.

Feedback

Found a bug or a rough edge? Please open an issue — for anything exploitable, contact a maintainer directly instead.

Assets 30
Loading