OwnTransit 1.0.5 — relay availability fixes

OwnTransit 1.0.5 contains two Relay availability fixes.

• Give each original public TCP peer its own bounded pre-authentication quota through managed Nginx, Caddy and Apache routes. Reject spoofed or ambiguous private-hop metadata and prevent Apache hop-header nomination from removing the quota field.
• Separate short-lived, evictable pending advertisements/offers from exact locally approved receiver capacity. Preserve signed expiry, token recovery, approved restart restoration, removal and explicit reapproval.
• Update recognized existing Relay routes with protected backups and interrupted-update rollback. Preserve inherited Nginx carrier headers.

Upgrade the Relay with the 1.0.5 installer, then choose Start or update this relay for its existing URL. Updating only the container does not reconcile an old route. Nginx RealIP and Apache mod_headers support are required; unsafe custom routing fails validation without replacing the previous selection.

Existing Client/Target pairings remain compatible. This release changes no authenticated wire profile, endpoint trust, SSH keys/accounts/configuration or fixed tcp4 127.0.0.1:22 target. It uses the existing distribution signer and immutable nine-asset release lane. A malicious Relay can still deny service, and sustained public pressure can still disrupt pending setup.

The conditional raw-command finding in the separately shipped historical 0.1.0 administrator-led profile is not changed; those commands are absent from the current Client/Relay/Target distribution.

Validation: both native race/vet profiles, vulnerability analysis, root lifecycle/worker confinement, provider, installer, signature-helper, source/history and CodeQL checks passed on Linux amd64/arm64 and Apple silicon. The exact signed Linux roles executed natively on both architectures. The signed Mac client matches the exact bytes executed by Apple-silicon CI. All nine assets were downloaded from the draft, signature/inventory verified and compared byte-for-byte before publication.

Source: be3b13171afda4ee5a65c27184e8d7609be0c2a9 (merged release PR). No live operator tunnel deployment, extended soak or independent security certification is claimed.

OwnTransit 1.0.4 hotfix

OwnTransit 1.0.4 hotfix

Recovers an existing pairing when a pending credential renewal expires before the Target commits it, or when delivery and commit status are ambiguous. Version 1.0.3 recovered only a committed renewal with an expired acknowledgement; it could still leave the Client retrying an uncommitted expired request indefinitely.

The Client now obtains a signed, encrypted snapshot of the Target's renewal generation before preparing a replacement. A timeout or Relay error is never evidence that a request did not commit. The snapshot grants no credentials: a fresh ordinary renewal and current end-to-end authentication are still required before SSH. Recovery preserves pairing identity, pinned trust, the Relay URL and operator-owned SSH settings.

Upgrade Target and Client

Both endpoints need 1.0.4 for the new recovery. Upgrade the Target first when practical. The Relay does not require an upgrade for this fix.

On the Linux Target, using your existing maintenance connection or console:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.4/install-linux.sh | sudo sh -s -- target
sudo owntransit-target setup

Choose Continue tunnel for the affected existing tunnel so its service runs the upgraded Target. Select each affected named tunnel as appropriate. A Target restart can interrupt its active SSH streams.

On an Apple-silicon Mac Client, run as your ordinary user, without sudo:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.4/install-macos.sh | sh -s -- client

On a Linux amd64 or arm64 Client:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.4/install-linux.sh | sudo sh -s -- client

Then retry your existing SSH command, or choose Continue tunnel for the existing Client tunnel. Do not delete pairing state or choose New to recover this condition. Existing broken SSH streams need a new SSH command; application bytes are never replayed.

Recovery and compatibility

• Repeated request/response expiry does not accumulate or exhaust a list of fallback requests. A fresh authenticated query can reconcile again on the next opening.
• New request material and operational keys are saved together atomically. Interrupted exchanges and lost Target acknowledgements resume the retained request.
• A delayed old request can win a race after a snapshot. The existing generation check rejects the competing request; the next opening reconciles again.
• Queries have a distinct versioned profile, schemas and signature domains. Ordinary renewal messages, carrier framing, TLS profiles and private-state schemas are unchanged. Existing relays carry opaque bounded blobs.
• Older Targets still support ordinary renewal and 1.0.3 committed-receipt recovery. They reject the new query; no weaker authentication, trust reset or automatic re-pairing is selected. Transient dialing failures retain ordinary retries for those peers.
• Rollback preserves readable ordinary pending/active state, but may restore the old recovery limitation. It never rolls back Target authority, clears alarms, or authorizes restoring an old state backup. Older installers may refuse newer managed aliases; binary/service rollback requires explicit local operator control.
• Initial pairing-code expiry, expired issuer roots, deliberately removed/alarmed/revoked pairings, and cloned or rolled-back authority are separate conditions. This hotfix does not bypass them.

Validation and signed assets

The release uses the existing distribution signer and nine-asset format for Linux amd64, Linux arm64 and the Apple-silicon Mac Client. Source regression coverage includes repeated committed/uncommitted expiry, delayed competing commits, restart boundaries, lost or unsupported status replies, cancellation, alarms/revocation, malformed/forged/crossed/stale replies, generation bounds and legacy renewal behavior. Installers recognize exact 1.0.3 predecessors while preserving pairing and SSH state.

Native Linux amd64 passed both race profiles, both vet profiles, and the security/publication gates using Go 1.26.7. Native Linux arm64 hardware passed both ordinary test profiles, both vet profiles and the same gates; its 39-bit kernel cannot execute Go's race detector, so native arm64 CI supplies race coverage. The required platform CI also exercises installer/service boundaries and the Mac Client.

The exact signed Linux capsules were independently verified and their Client, Target and Relay version commands executed on matching amd64 and arm64 hosts. Each reports 1.0.4 from source commit 5519f367b2f8ef04ed428a4d4249297f24817c3d; the Target retains fixed tcp4 127.0.0.1:22. These were isolated artifact checks, not live installation or tunnel recovery.

The initial installer download trusts GitHub HTTPS. Each installer then verifies the pinned distribution key, signed inventory and selected archive. Release files are built from the tagged source, signed with the existing key, and downloaded and verified before publication. No live deployment or recovery of a particular operator tunnel is claimed.

Change and CI evidence (#38) · Protocol and rollback · Recovery guide · Full comparison

OwnTransit 1.0.3 hotfix

OwnTransit 1.0.3 hotfix

Fixes a reconnect failure when the Target committed a credential renewal but the Client missed the response until it expired. Retrying the retained request previously returned the same expired response and failed with a local-state error.

The Client now authenticates that exact response as a receipt, saves a fresh renewal request and new operational keys atomically, and requires current authorization before opening the tunnel. Existing pairing identity, pinned trust, Relay URL and SSH settings are preserved. An interruption resumes the saved request.

Upgrade the Client

This fix requires upgrading the Client computer. The Target and Relay do not need an upgrade for this recovery.

Apple-silicon Mac — run as your ordinary user, without sudo:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.3/install-macos.sh | sh -s -- client

Linux amd64 or arm64 Client:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.3/install-linux.sh | sudo sh -s -- client

Then retry your existing SSH command or choose Continue tunnel for the existing tunnel in owntransit-client setup. Do not create a new pairing or delete saved state to recover this condition. Recognized 1.0.2 installations upgrade while retaining their pairing and previous software.

The fix applies to a renewal the Target already committed. Initial pairing expiry and expired requests that were never committed remain outside this recovery path. Local alarms and revocation continue to block access. Existing broken SSH streams require a new SSH command.

Included and verified

• Recovery regression tests cover expired responses and operational certificates, interrupted fresh exchanges, retained identity/trust, local alarms, revocation, and incorrectly signed or bound receipts.
• The existing wire and private-state schemas, independent TLS boundaries, fixed Target destination tcp4 127.0.0.1:22, and distribution signer remain unchanged.
• The three platform capsules and both installers identify 1.0.3. The release retains the existing nine-asset format and signature namespace. The initial installer download trusts GitHub HTTPS; the installer then authenticates the pinned signer, signed inventory and selected archive.
• Release assets are built from the tagged source, signed with the existing distribution key, and downloaded and verified before publication. No manual live-host recovery or deployment is claimed by this release.

Change and CI evidence (#37) · Recovery guide · Full comparison

OwnTransit 1.0.2

OwnTransit 1.0.2

Your SSH. Your keys. Untrusted transit.

This patch shortens setup when the Relay is already running. Create a tunnel on the Target, keep its screen and private code available, then choose New tunnel on the Relay and enter the Target's public Target ID. The Relay creates and approves that tunnel in the same visit. Continue directly to the Client and paste the private otpair2. code into its hidden prompt. The Relay never issues or needs that private code.

If the Target does not yet exist, pressing Enter at the Relay's new public-ID prompt saves a draft. Create the Target, then choose Continue a tunnel on the Relay to approve the saved draft. Returning to the Target to retrieve its unused private code is only a recovery step if the original code was lost. A bound Relay entry cannot be silently rebound to another Target.

What changed

• New Relay tunnels can approve an already-created public Target ID without a second Relay menu visit. The Target, Relay and Client handoffs now explain the direct path and the lost-code recovery path.
• The public-ID prompt rejects malformed IDs and private-code input without approving or reflecting the input. Relay approval remains UNDER CONSTRUCTION until the Client completes its live authenticated carrier check; it is not an SSH login or a readiness claim.
• Linux and macOS installers and release capsules identify 1.0.2. Upgrades from the recognized 1.0.1 installation retain pairing identities, pending codes and operator-owned SSH settings. The existing signer, signature namespace, fixed Target SSH destination and authenticated wire profiles remain in use.

Install or upgrade

Supported platforms are Linux amd64/arm64 and the Apple-silicon macOS Client. Canonical 0.7, 0.8, 1.0.0 and 1.0.1 installations are recognized upgrade predecessors.

Run only the command for the machine's role. Existing users should choose Start or update this relay on the Relay and Continue tunnel on each Target and Client. Do not choose New or replace identities just to update software. Restarting a Target can interrupt existing SSH sessions; keep an independent maintenance path available.

Public Linux VPS — Relay:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.2/install-linux.sh | sudo sh -s -- relay
sudo owntransit-relay setup

Private Linux SSH machine — Target:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.2/install-linux.sh | sudo sh -s -- target
sudo owntransit-target setup

Linux Client:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.2/install-linux.sh | sudo sh -s -- client
owntransit-client setup

Apple-silicon Mac Client, without sudo:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.2/install-macos.sh | sh -s -- client
"$HOME/.local/bin/owntransit-client" setup

The download step initially trusts GitHub HTTPS. The installers then check the pinned distribution public key, detached inventory signature and selected archive digest before extraction or execution. The nine assets are the two installers; Linux amd64, Linux arm64 and macOS arm64 capsules; DEVELOPMENT.txt; DEVELOPMENT-SHA256SUMS; its .sig; and distribution-public.key.

Verification and scope

The source passed both Go race and vet profiles, security and complete-history publication checks, native platform CI, isolated macOS installer and Linux container installer/service fixtures, and release/signature helper checks. CI fixture timing was corrected for race-instrumented hosts without changing production behavior. The release assets were built twice with pinned Go 1.26.7 and compared byte for byte. The signed published inventory is the authority for the exact nine assets.

This release changes setup handoffs, not SSH ownership or the inner authentication boundary. It does not claim an independent security assessment, pristine-host qualification, extended soak or a live upgrade of any particular installation. A broken SSH stream still needs a new SSH command after connectivity returns, and a malicious or unavailable Relay can deny service.

Quickstart · SSH/SCP and recovery guide

Changes: setup handoffs (#35) · qualification fixtures (#36) · full comparison

OwnTransit 1.0.1

OwnTransit 1.0.1

Your SSH. Your keys. Untrusted transit.

Network-recovery patch for Client / Relay / Target. Ordinary outages retry with
the existing pairing; no new codes, trust reset or automatic killswitch.

Install or upgrade

Run only the command for that machine's role.

Public Linux VPS — Relay:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.1/install-linux.sh | sudo sh -s -- relay

Select the existing Relay and Start or update this relay. Reopen the menu
with sudo owntransit-relay setup. Other instances are not selected for an image
upgrade automatically.

Private Linux SSH machine — Target:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.1/install-linux.sh | sudo sh -s -- target
sudo owntransit-target setup

Choose Continue tunnel for each existing tunnel to start the installed
version. Restarting the Target interrupts its existing connections; keep
independent maintenance access available.

Linux Client:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.1/install-linux.sh | sudo sh -s -- client
owntransit-client setup

Apple-silicon Mac Client, without sudo:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.1/install-macos.sh | sh -s -- client
"$HOME/.local/bin/owntransit-client" setup

On an existing Client choose Continue tunnel to verify the retained pairing.
Do not choose New or replace identities just to upgrade. Canonical 0.7, 0.8 and
1.0.0 package predecessors are recognized. SSH keys and settings remain yours.

What changed

• Bounded exponential retry backoff with jitter replaces rapid outage loops.
• HTTP 429 has a specific local diagnostic; Retry-After hints are bounded to
  5–30 seconds and cannot alter trust or indefinitely suspend local recovery.
• The Target recovers from repeated network disconnects and offline startup
  without a process restart, provided connectivity and valid local state return.
• New Client connections retry within the existing 30-second opening budget;
  credential exchanges have per-attempt bounds. Successful promotion retires
  the opening timer so it cannot kill a live SSH stream.
• Explicit alarms remain terminal and interrupt retry waits. Existing inner
  authentication, leases, fixed SSH target and wire profiles are unchanged.

The tests include real isolated WebSocket/mTLS/SSH outage recovery, retained
identities, rate limits, cancellation, offline startup and alarm handling. The
old 1.0 worker fails the new rapid-retry regression. This is not independent
security certification or a claim of universal availability.

Important limits

A broken SSH stream is closed, never replayed into a new carrier. Start a new
SSH command after connectivity returns. Retry is per loop, not a host-wide
quota across every tunnel or NAT peer; retain appropriate reverse-proxy limits.
An unavailable network, malicious Relay or broken host can still deny service.

Linux amd64/arm64 and Apple-silicon macOS Client are supported. Existing signer,
signature namespace and historical DEVELOPMENT inventory names are retained.
Initial installer delivery trusts GitHub HTTPS; downloaded archives are checked
against the pinned signer and signed inventory. Older releases are unchanged.

Quickstart ·
SSH/SCP and upgrade guide

OwnTransit 1.0.0

OwnTransit 1.0.0

Your SSH. Your keys. Untrusted transit.

The 1.0 feature baseline ships the existing Client / Relay / Target runtime, including bounded pending reconnects, named tunnels, local recovery menus and independent end-to-end encryption. It introduces no new transport or enrollment protocol.

Install or upgrade

Choose the role on the corresponding machine. Existing installations keep their pairing; do not create new identities just to upgrade.

Public Linux VPS — Relay:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.0/install-linux.sh | sudo sh -s -- relay

For an existing Relay, select Start or update this relay in its menu. Reopen it with sudo owntransit-relay setup.

Private Linux SSH machine — Target:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.0/install-linux.sh | sudo sh -s -- target
sudo owntransit-target setup

Choose Continue tunnel for each existing tunnel to run the installed version. Restarting its service interrupts current connections.

Linux Client:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.0/install-linux.sh | sudo sh -s -- client
owntransit-client setup

Apple-silicon Mac Client, without sudo:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.0/install-macos.sh | sh -s -- client
"$HOME/.local/bin/owntransit-client" setup

On an existing Client, Continue tunnel checks the retained pairing. For a new installation, follow the quickstart. SSH/SCP examples and operational limits are included.

Scope and compatibility

• Supported: Linux amd64 and arm64; Apple-silicon macOS Client.
• Recognized canonical 0.7.0 and 0.8.0 installations can upgrade without re-pairing. Earlier releases remain immutable.
• The documented Client / Relay / Target commands and pairing-state upgrade path establish the 1.x compatibility baseline.
• Same SSH-only, fixed local SSH destination and malicious-relay threat model as 0.8. SSH identities, permissions and host verification remain operator-owned.
• The existing distribution signer and nine assets are retained. DEVELOPMENT-* inventory names and the signing namespace are historical format identifiers, not a new trust ceremony.

Known operational limits

Current retries do not adapt to HTTP 429. Restrictive reverse-proxy quotas can prevent reconnection and may appear as a generic transport error. Keep protection enabled, size it for the combined handshake/renewal workload, and inspect proxy logs when diagnosing failures.

Keep independent maintenance access to unattended machines: the Relay cannot restart a Target through a broken tunnel. Publishing or downloading this release does not update live services or resolve an existing outage automatically.

The 1.0 label does not claim independent security certification, universal availability, pristine-host qualification, an extended soak, or Apple notarization. Initial installer delivery trusts GitHub HTTPS; the installer then verifies the pinned signer, signed inventory and exact archive bytes.

OwnTransit 0.8.0 — bounded reconnects

OwnTransit 0.8.0

Recover stalled pending relay connections without resetting the pairing.

• Local 45-second bound on runtime preface, outer TLS and READY waits after the WebSocket dial. A silent attempt is aborted and the Target retries using the same identity.
• The guard is retired before promotion: established SSH streams are not replayed, reconnected or killed by a startup timer.
• Fixed, rate-limited Target timeout notices and a specific Client pending-stall diagnostic.
• Canonical 0.7.0-to-0.8.0 package upgrades retain pairing state, previous software and operator-owned SSH settings.
• The exact legacy /connects/enrollment sibling no longer blocks reuse of the separate exact /connects route. No website rewrite or weaker route matching is required.

Update the Target first

On the private Linux machine running SSH:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v0.8.0/install-linux.sh | sudo sh -s -- target
sudo owntransit-target setup

Choose Continue tunnel for each existing tunnel to start the installed version. A service restart briefly interrupts its connections. Do not create a new tunnel or replace pairing keys just to upgrade. Keep independent SSH or console access during service updates.

Update Client and Relay

On a Linux Client:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v0.8.0/install-linux.sh | sudo sh -s -- client
owntransit-client setup

On an Apple-silicon Mac Client, without sudo:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v0.8.0/install-macos.sh | sh -s -- client
"$HOME/.local/bin/owntransit-client" setup

Choose Continue tunnel to verify the retained Client pairing.

On the public Linux VPS:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v0.8.0/install-linux.sh | sudo sh -s -- relay

Select the intended existing Relay and Start or update this relay. Use its existing URL. To reopen the menu: sudo owntransit-relay setup.

Supported: Linux amd64/arm64 and Apple-silicon macOS Client. Full guide.

The existing distribution signer authenticates the exact nine assets; prior releases remain immutable. The initial installer delivery trusts GitHub HTTPS. No new cryptographic profile, SSH management, Apple notarization, extended soak or independent security certification is introduced. The pending-stall defect is reproduced in isolated tests; an earlier live network trigger is not claimed proven after process restart.

OwnTransit 0.7.0 — Client / Relay / Target

OwnTransit 0.7.0

Client. Relay. Target. One local menu, one next step.

• Canonical commands: owntransit-client, owntransit-relay, owntransit-target.
• New / Continue / List / Remove tunnel menus. Endpoints also have explicit Restore and terminal Killswitch choices.
• One private pairing code, retained on the Target until used or expired. No private code on the Relay.
• Relay drafts and scoped admission removal. Only the Client's authenticated end-to-end check reports TUNNEL READY.
• Preserved pairing state, exact managed-service migration, and unchanged SSH ownership and inner encryption boundaries.

Install

On the public Linux VPS:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v0.7.0/install-linux.sh | sudo sh -s -- relay

On the private Linux Target running SSH:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v0.7.0/install-linux.sh | sudo sh -s -- target
sudo owntransit-target setup

On a Linux Client:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v0.7.0/install-linux.sh | sudo sh -s -- client
owntransit-client setup

On an Apple-silicon Mac Client, without sudo:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v0.7.0/install-macos.sh | sh -s -- client
"$HOME/.local/bin/owntransit-client" setup

Run each command separately, then answer the menu. Follow the short quickstart.

Upgrading

Use the installer for each local role. On the Relay, select Start or update this relay. On each existing Target tunnel, choose Continue tunnel; on the Client, Continue checks the retained tunnel. Do not replace pairing identities for a software update.

Names and commands deliberately change before 1.0; use these commands, not old preview aliases. Recognized managed installations retain state. Unknown commands, modified units and unrelated sites are not overwritten. Existing release assets are unchanged.

Endpoint Remove is recoverable and keeps private state. Killswitch is permanent for that pairing. Relay removal is an availability operation, not endpoint revocation against a malicious Relay.

Verification scope

The existing distribution signer authenticates the exact archives through DEVELOPMENT-SHA256SUMS and its detached signature. That retained namespace is not a new assurance claim. Initial installer delivery trusts GitHub HTTPS. No Apple notarization, pristine-host qualification, extended soak or independent external security certification is claimed.

Supported: Linux amd64 and arm64; Apple-silicon macOS Client. Runtime remains an SSH byte carrier with a build-fixed local SSH destination.

OwnTransit 0.6.1 — Recoverable setup and end-to-end readiness

OwnTransit 0.6.1 makes setup recoverable and distinguishes saved progress from a working end-to-end tunnel.

• Lost the code? New receiver setup keeps an owner-only local copy. Retrieve the same unused, unexpired code with the exact command printed by setup or VPS approval. The private code never goes to the relay or its network worker.
• Retry without starting over. Normal setup retains pending and paired identities. Creating fresh receiver identities now requires explicit --replace; paired replacements still ask for confirmation. A new receiver ID comes with its exact new approval command.
• Know what to run next. pair next prints commands for the selected tunnel's actual state. Missing approval, interrupted client requests, stopped services, expired codes and alarms have distinct recovery instructions. Commands appear on standalone copyable lines.
• Ready means checked. Setup and resume run the real end-to-end carrier check before reporting TUNNEL READY. Relay setup/approval are only UNDER CONSTRUCTION steps. pair check repeats the test without replacing the pairing. SSH login still uses your own keys and host verification.
• Installers accept 0.6.0 upgrades on Linux amd64/arm64 and Apple-silicon Macs, preserving pairing and SSH settings. Existing release bytes remain immutable.

Quickstart · Setup recovery

Existing lost codes: versions 0.6.0 and earlier did not retain the private code. An upgrade cannot reconstruct it from a hash. The new retrieval command explains the explicit one-time replacement and new-ID approval when needed; it never silently resets your pairing.

The wire protocol, encryption, endpoint authority and fixed SSH destination remain unchanged. The private cache is validated against authoritative pending state and cannot revive a consumed, expired or alarmed pairing. No independent security certification is claimed.

Verification includes both race/vet profiles, source/security checks, lost-code recovery followed by real SSH through the integration fixture, negative cache/identity/permission tests, real Linux CLI retry and explicit-replacement dispatch in an isolated container, and isolated Mac installer upgrade/reinstall/removal checks. No new live-deployment end-to-end result or pristine-host qualification is claimed.

OwnTransit 0.6.0 — Relay migration and straightforward setup

OwnTransit 0.6.0 completes the relay migration and setup flow: enter your existing relay URL, review a recognized legacy installation if found, and continue with the machine-specific NEXT instructions.

• URL-first selection removes the need to remember a local instance name. Explicit selectors remain restrictive; existing relays are never silently repointed.
• Recognized manual relay services are replaced with managed services while retaining their keys, data mount, port and website route. Superseded containers and service units are removed after verification; unrelated relays and sites are preserved.
• Interrupted migrations and upgrades use checked, durable recovery. Unknown ownership, conflicting routes, unexpected identities and unsafe files fail closed.
• A short four-step quickstart identifies the VPS, receiving SSH machine and client. The client needs only the private 56-character receiver code; there is no VPS code to copy.
• Large unrelated reverse-proxy fragments no longer block valid site discovery. Website routes are checked before fresh identities are created.
• If a verified HTTPS request receives HTTP 403 from the VPS's own website policy, setup can report local verification only after exact route, service and retained-identity checks. It does not weaken the policy or claim public reachability; endpoints still verify their actual public connections normally.

Start with the 0.6.0 quickstart. For upgrades, rerun the installer for the local role. On the VPS enter its existing URL; on paired receivers follow the printed restart command instead of re-pairing. See migration and recovery.

Both independent TLS boundaries and the fixed receiver target 127.0.0.1:22 remain unchanged. SSH accounts, keys, host verification and configuration remain yours. Do not send the private pairing code to the VPS.

Downloads support Linux amd64/arm64 and Apple-silicon macOS clients, using the existing distribution signer and nine-asset inventory. Historical preview filenames remain for compatibility. No extended soak, pristine-host certification or independent external security certification is claimed.

Verification status

Passed: CI on Linux amd64, Linux arm64 and Apple silicon, including both race/vet profiles, security scanning, installer and relay migration/rollback fixtures. The exact signed Mac capsule passed isolated installation, reinstall and removal. The exact signed relay passed live migration, repeat setup and service restart, with retained keys, public WebSocket reachability and preservation of an unrelated relay and websites verified.

Pending manual verification: the final live Mac → relay → Linux SSH end-to-end test using all three exact 0.6.0 components. The maintainer will perform this after publication; it is not recorded as passed. Keep independent SSH or console recovery access while testing.