Skip to content

NexaPipe v0.4.0

Choose a tag to compare

View all tags
@open-nexa open-nexa released this 01 Oct 01:20
· 304 commits to main since this release
v0.4.0
9703fdd
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The desktop app now asks the machine who is using it before it shows anything, and a server whose backends are all down says so instead of dialling.

Downloads

One tag ships all three products, and every file below is attached to this
release.

Desktop & mobile app — nexa

Architecture Windows macOS Linux Android
x86-64 (64-bit) Installer Disk image DEB · RPM · AppImage APK — emulator images
AArch64 (ARM64) Installer Disk image DEB · RPM · AppImage APK — every phone

One APK per ABI rather than one carrying both: a fat APK would make every phone
download the x86_64 library to get the arm64 one.

Server & client library — nexapipe

Architecture Linux (glibc) Linux (musl, static) macOS Windows
x86-64 (64-bit) tar.gz tar.gz tar.gz zip
AArch64 (ARM64) tar.gz tar.gz tar.gz zip

Each archive holds the nexapipe binary, the client cdylib for embedding,
config.toml.2fa.example, the README and the licence. The macOS updater bundles
and their .sig files, latest.json, each APK's .sha256 sidecar and
SHA256SUMS.txt are attached as well.

What's new

  • Desktop: the whole Config page — nodes, domains, connection strings,
    two-factor secrets, the relay — renders nothing until the machine confirms the
    user, and stays open for two minutes at a time. The relay moved from Settings
    onto that page.
  • Server: a route whose backends are all unhealthy refuses with 503
    instead of dialling into a timeout; least_conn joins round_robin and
    random; [timeouts] makes the connect and response deadlines
    configuration.
  • Client: every backend is probed on a timer and
    EndpointGroup::health_snapshot() reports what each answered.
  • Tunnel: a proxied domain answers AAAA as well as A, from a ULA block
    routed into the TUN; the server can bind [::] too ([iroh] bind_ipv6).
  • Android: the app asks before taking another app's VPN slot, and ships one
    APK per ABI — arm64-v8a for a phone, x86_64 for an emulator.

Fixed

  • The DNS cache in the TUN proxy answered more than it held; its tests now run
    in CI.
  • Linux keeps the desktop credential store's master key in the Secret Service.
  • A node's connection string no longer sits in localStorage in the clear — it
    moved into the encrypted store.
  • Desktop masks are computed in Rust, and an invite's secret and enrolment token
    are filed by Rust rather than handed to the renderer.
  • A confirmation the machine refused says why, instead of changing nothing.

Full details, install commands, checksums and upgrade notes:
https://open-nexa.github.io/nexapipe/v0.4.0.html · complete history in
CHANGELOG.md ·
what comes next in
docs/ROADMAP.md.

What shipped, in the order it landed:
#56 [timeouts], least_conn
and the refusal when every backend is down ·
#57 the desktop credential door ·
#58 asking before another app's
VPN is taken ·
#59 the second Android ABI ·
#60 IPv6 in the tunnel and the
backend probe ·
#61 this release's download page ·
#62 the door as a page, the
refusal that says why, and the relay on Config.

NexaPipe is licensed under the terms in LICENSE.

Assets 38
Loading