OwnTransit 1.0.1

OwnTransit 1.0.1

Your SSH. Your keys. Untrusted transit.

Network-recovery patch for Client / Relay / Target. Ordinary outages retry with
the existing pairing; no new codes, trust reset or automatic killswitch.

Install or upgrade

Run only the command for that machine's role.

Public Linux VPS — Relay:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.1/install-linux.sh | sudo sh -s -- relay

Select the existing Relay and Start or update this relay. Reopen the menu
with sudo owntransit-relay setup. Other instances are not selected for an image
upgrade automatically.

Private Linux SSH machine — Target:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.1/install-linux.sh | sudo sh -s -- target
sudo owntransit-target setup

Choose Continue tunnel for each existing tunnel to start the installed
version. Restarting the Target interrupts its existing connections; keep
independent maintenance access available.

Linux Client:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.1/install-linux.sh | sudo sh -s -- client
owntransit-client setup

Apple-silicon Mac Client, without sudo:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.1/install-macos.sh | sh -s -- client
"$HOME/.local/bin/owntransit-client" setup

On an existing Client choose Continue tunnel to verify the retained pairing.
Do not choose New or replace identities just to upgrade. Canonical 0.7, 0.8 and
1.0.0 package predecessors are recognized. SSH keys and settings remain yours.

What changed

• Bounded exponential retry backoff with jitter replaces rapid outage loops.
• HTTP 429 has a specific local diagnostic; Retry-After hints are bounded to
  5–30 seconds and cannot alter trust or indefinitely suspend local recovery.
• The Target recovers from repeated network disconnects and offline startup
  without a process restart, provided connectivity and valid local state return.
• New Client connections retry within the existing 30-second opening budget;
  credential exchanges have per-attempt bounds. Successful promotion retires
  the opening timer so it cannot kill a live SSH stream.
• Explicit alarms remain terminal and interrupt retry waits. Existing inner
  authentication, leases, fixed SSH target and wire profiles are unchanged.

The tests include real isolated WebSocket/mTLS/SSH outage recovery, retained
identities, rate limits, cancellation, offline startup and alarm handling. The
old 1.0 worker fails the new rapid-retry regression. This is not independent
security certification or a claim of universal availability.

Important limits

A broken SSH stream is closed, never replayed into a new carrier. Start a new
SSH command after connectivity returns. Retry is per loop, not a host-wide
quota across every tunnel or NAT peer; retain appropriate reverse-proxy limits.
An unavailable network, malicious Relay or broken host can still deny service.

Linux amd64/arm64 and Apple-silicon macOS Client are supported. Existing signer,
signature namespace and historical DEVELOPMENT inventory names are retained.
Initial installer delivery trusts GitHub HTTPS; downloaded archives are checked
against the pinned signer and signed inventory. Older releases are unchanged.

Quickstart ·
SSH/SCP and upgrade guide