v0.5.2

tui-wireguard v0.5.2

tui-wireguard 0.5.2

• Forwarding server on firewalld (#30). When firewalld is running, N as a forwarding server writes a firewalld policy into the conf instead of iptables FORWARD and MASQUERADE rules, which firewalld's own forward chain overruled. PostUp creates the policy <interface>-fwd (ingress ANY, egress the egress NIC's zone, accept and masquerade scoped to the peers' network and each destination) with firewall-cmd --permanent and reloads; PostDown deletes it and reloads, so down puts firewalld back as it was. The dialog says that each reload drops runtime-only firewalld changes.
• The WireGuard interface is bound to the zone it falls into (and unbound at down) only when the egress NIC is not bound to a zone either: firewalld dispatches no policy between two interfaces that are both only in the default zone's catch-all. With a NIC NetworkManager manages, nothing is bound.
• Known limitation, Ubuntu 26.04: its AppArmor wg-quick profile denies the hooks' sysctl -w net.ipv4.ip_forward=1, so a forwarding server there needs ip_forward turned on by hand (documented in the README). Not new in this release.
• Port step on a firewalld forwarding server is firewall-cmd --permanent --add-port=<port>/udp, since the interface's reload at up would drop a runtime-only port.
• FORWARD column and --check read firewalld (firewall-cmd --list-all-policies and --list-all-zones) when it is running. --check adds forwardingChecked, forwardingSource (firewalld or iptables) and forwardingManager (firewalld or ufw).
• ufw hosts and hosts with a plain nftables or iptables ruleset keep the iptables rules and read.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, checksums.txt carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

Changelog

• be4edba 0.5.2: forwarding server on firewalld builds a firewalld policy and reads it back (#30) (#31)

v0.5.1

tui-wireguard v0.5.1

tui-wireguard 0.5.1

• Add peer: endpoint and persistent keepalive (#27). After the key line, a asks for the peer's endpoint (host:port or [v6]:port, validated) and a persistent keepalive (0-65535 seconds, empty or 0 is off, prefilled with 25 once an endpoint is given). Both are optional and land on the one previewed wg set … endpoint … persistent-keepalive …, so wg-quick save persists them and the peers screen shows them (ENDPOINT, KEEP). A bad value reopens its step with the value as typed and the reason; a bad key line is reported before the optional steps open.
• UDP IN reads the firewall in charge (#28). The interfaces screen's UDP IN column and --check's listenPortInput now read tui-firewall --check when tui-firewall is installed, else nft -j list ruleset (following jumps and gotos into user chains), else iptables -S. firewalld's rules, in its own nftables table, are seen at last. Undetermined (a jump that cannot be followed, a firewalld service whose ports are unknown) reads ? / unknown, never closed. --check adds firewallSource and firewallManager.
• Port step on firewalld. The create wizard opens the listen port with firewall-cmd --add-port=<port>/udp on a firewalld host (an iptables INPUT rule sits in a table firewalld's reject never consults), and each firewall gets its own "to keep it" hint (firewall-cmd --permanent, ufw allow, netfilter-persistent save).
• tui-kit v0.4.4: runner children get no controlling terminal (a prompt fails fast instead of hanging behind the TUI); a failed step's status line goes through runner.StatusLine. go get -u on the rest.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, checksums.txt carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

Changelog

• fd9c9b7 0.5.1: endpoint and keepalive on add-peer; firewall-aware UDP IN; tui-kit v0.4.4 (#27 #28) (#29)

v0.5.0

tui-wireguard v0.5.0

tui-wireguard 0.5.0: tui-vpn is now tui-wireguard

WireGuard interfaces and peers from the terminal: status, peers, a new interface as an endpoint or as a forwarding server (IP forwarding, FORWARD rules, NAT and the listen port previewed together), persistence with wg-quick, and a down interface kept on screen so it can be brought back up. The Headscale control plane moved to tui-tailscale. The package replaces tui-vpn on apt, dnf and pacman; configuration under the old tui-vpn paths is still read. Built with tui-kit v0.4.3.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, checksums.txt carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

Changelog

• 4ed0063 Become tui-wireguard: WireGuard only; Headscale moved to tui-tailscale (#26)
• cb69e9c Host validation, stopped-unit screens, OIDC presets, forwarding server, routes approval (#25)

v0.4.0

tui-vpn v0.4.0

Control plane from the tool: transport choice (plain http, Let's Encrypt, own certificate, reverse proxy) and MagicDNS base domain in S, enable at boot, state ownership check and fix. Validated on a real Ubuntu 24.04 host: Let's Encrypt on 443, OIDC against Google, first node registered through the browser.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, checksums.txt carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

Changelog

• 08b5666 Bump anchore/sbom-action/download-syft in the github-actions group (#11)
• 2951e47 Bump the github-actions group with 4 updates (#12)
• ca09f20 Control plane: transport choice, unit enable, state ownership (#20)
• a7f73de README: link the tool's page on tui.tools (#10)
• e4d3253 README: point the install snippet at the current release (#9)

v0.3.0

tui-vpn v0.3.0

v0.3.0: headscale server settings and OIDC identity provider setup from the users screen

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, checksums.txt carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

Changelog

• e305fd9 Manage the control plane's identity, not just report on it (#8)

v0.2.1

tui-vpn v0.2.1

tui-kit v0.3.0: the dialogs wrap and scroll instead of clipping the
command preview, and the picker filters as you type.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, checksums.txt carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

Changelog

• acb05fb Bump tui-kit to v0.3.0 (#7)
• 35cc8c9 tool.json: released (#6)

v0.2.0

tui-vpn v0.2.0

Manage, not view: create and edit from the TUI (wave 1), lab-validated on the router image.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, checksums.txt carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

Changelog

• b40ba2f Manage, not view: interface bootstrap, persistence, preauth create, node ops (#5)

v0.1.0

tui-vpn v0.1.0

First validated release: the router-1.0 lab ran this tool against real VMs (tui-lab router topology).

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, checksums.txt carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

Changelog

• 237b88f Bump anchore/sbom-action/download-syft in the github-actions group (#1)
• 99ad5cf Initial commit
• 25578d4 Phase 1: WireGuard + Headscale (read-mostly, previewed mutations) (#2)
• e546638 Render the screenshots from the demo, and name them for the real screens (#3)
• 9bf282e headscale: read the gRPC-gateway build's protobuf-json (0.2x), not just ogen (#4)