chore: add GUI quickstart docs and update README for 0.1.0-beta.0

README.md

@@ -7,7 +7,7 @@
   **TCP-Native VPN. Works Where UDP Doesn't.**
 
   [![License: Proprietary](https://img.shields.io/badge/license-Proprietary-red)](LICENSE)
-  [![Platform](https://img.shields.io/badge/platform-Linux%20%7C%20macOS%20%7C%20Android%20%7C%20iOS-lightgrey)]()
+  [![Platform](https://img.shields.io/badge/platform-Linux%20%7C%20Windows%20%7C%20Android-lightgrey)]()
   [![Status](https://img.shields.io/badge/status-Beta-orange)]()
 
 </div>
@@ -33,7 +33,7 @@ Most VPNs treat TCP as a fallback. Konduit is designed for TCP from the ground u
 - **Userspace implementation** — no kernel modules, no root required
 - **Hot config reload** — update server configuration without dropping connections
 - **QR code provisioning** — scan once, connect instantly
-- **Cross-platform** — Linux, macOS, Android, iOS
+- **Cross-platform** — Linux, Windows, Android (macOS and iOS coming soon)
 - **Modern cryptography** — X25519 key exchange, ChaCha20-Poly1305 data channel
 - **Stealth mode** — port 443 deployment with decoy proxy for hostile network environments
 - **Memory safe** — written entirely in Rust
@@ -42,11 +42,15 @@ Most VPNs treat TCP as a fallback. Konduit is designed for TCP from the ground u
 
 Releases are published on the [Releases](../../releases) page. Each release includes:
 
-| Binary | Purpose |
+| Artifact | Platform | Purpose |
-|---|---|
+|---|---|---|
-| `konduit-server` | VPN server |
+| `konduit-server-*-linux-x86_64` | Linux | VPN server |
-| `konduit` | CLI client (Linux) |
+| `konduit-*-linux-x86_64` | Linux | CLI client |
-| `konduit-ctl` | Server provisioning tool |
+| `konduit-ctl-*-linux-x86_64` | Linux | Server provisioning tool |
+| `Konduit-*-x86_64.AppImage` | Linux | GUI client (AppImage) |
+| `konduit-cli-*-windows-x86_64.zip` | Windows | CLI client + wintun.dll |
+| `konduit-gui-*-windows-x86_64.zip` | Windows | GUI client |
+| `konduit-*-android.aab` | Android | Android app (sideload via bundletool) |
 
 ### Linux (CLI)
 
@@ -61,14 +65,38 @@ echo "your secret mantra" | ./konduit-ctl bootstrap -l vpn.example.com:443 -p -
 ./konduit connect --config client.toml
 ```
 
-### macOS · Android · iOS
+### Linux (GUI)
+
+Download the `.AppImage`, make it executable, and run it:
+
+```bash
+chmod +x Konduit-*-x86_64.AppImage
+./Konduit-*-x86_64.AppImage
+```
+
+### Windows
+
+Extract the zip and run `konduit.exe` (CLI) or `Konduit.exe` (GUI). `wintun.dll` must remain alongside the executable.
+
+### Android
+
+Download from [Google Play](https://play.google.com/store/apps/details?id=eu.kaparulin.konduit) or sideload the `.aab` using [bundletool](https://github.com/google/bundletool).
+
+### macOS · iOS
 
 Coming soon.
 
-## Server Setup
+## Setup
 
+**GUI clients**
+- [Linux GUI Quickstart](docs/gui-quickstart-linux.md) — AppImage, privileges, autostart
+- [Windows GUI Quickstart](docs/gui-quickstart-windows.md) — extract, UAC, WinTun, autostart
+
+**CLI & server**
+- [Client Quickstart](docs/client-quickstart.md) — download, configure, connect, run as a systemd service
 - [Server Quickstart](docs/server-quickstart.md) — install, provision, NAT setup for iptables and firewalld
 - [Stealth Mode Setup](docs/stealth-setup.md) — HAProxy TCP passthrough + camouflage configuration
+- [systemd units](docs/systemd/) — service files for konduit-server, konduit (client), and konduit-admin-ui
 
 ## Architecture
 
@@ -119,8 +147,9 @@ The VPN server, management UI, and stealth-mode protocol are proprietary. Keepin
 ## About
 
 Created by **Eugen Kaparulin**.  
-Official binaries distributed by **K-Ops Oy**.
+Official binaries distributed by **[K-Ops Oy](https://k-ops.eu)**.
 
 © Eugen Kaparulin. All rights reserved.  
 [`konduit-platform`](./konduit-platform) is published under the [PolyForm Noncommercial License 1.0.0](LICENSE).  
-All other parts of Konduit are proprietary.
+All other parts of Konduit are proprietary.  
+[Privacy Policy](docs/privacy-policy.md)

docs/client-quickstart.md

@@ -0,0 +1,59 @@
+# Konduit CLI Client Quickstart
+
+## 1. Download
+
+Download the `konduit` binary from the [Releases](../../releases) page and make it executable:
+
+```bash
+chmod +x konduit
+sudo cp konduit /opt/konduit/konduit
+```
+
+## 2. Get a client config
+
+Your server administrator will provide a `client.toml` generated by `konduit-ctl add-client`. Transfer it to the client machine:
+
+```bash
+sudo cp client.toml /opt/konduit/client.toml
+sudo chmod 600 /opt/konduit/client.toml
+```
+
+If your server runs in stealth mode, the config already points to port 443. No additional client-side configuration is needed.
+
+## 3. Connect
+
+```bash
+/opt/konduit/konduit -c /opt/konduit/client.toml
+```
+
+A successful connection looks like:
+
+```
+→ resolving vpn.example.com  ok
+→ tcp handshake  X25519  ok
+→ tun device  konduit0  up
+→ routes applied by server policy  ok
+connected · no udp, no root, port 443
+```
+
+## 4. Run as a systemd service
+
+To connect automatically on boot, use the provided systemd unit:
+
+```bash
+sudo cp /opt/konduit/docs/systemd/konduit.service /etc/systemd/system/
+sudo systemctl daemon-reload
+sudo systemctl enable --now konduit
+```
+
+The unit runs as root (required for TUN device creation) and restarts automatically on failure.
+
+## 5. Capabilities (alternative to root)
+
+To run without root, grant the binary the required capability instead:
+
+```bash
+sudo setcap cap_net_admin=+ep /opt/konduit/konduit
+```
+
+Then change `User=root` to your user account in the systemd unit before enabling it.

docs/gui-quickstart-linux.md

@@ -0,0 +1,61 @@
+# Konduit GUI — Linux Quickstart
+
+## 1. Download
+
+Download the `Konduit-*-x86_64.AppImage` from the [Releases](../../releases) page.
+
+## 2. Make it executable
+
+```bash
+chmod +x Konduit-*-x86_64.AppImage
+```
+
+## 3. Run
+
+Double-click the AppImage in your file manager, or launch it from the terminal:
+
+```bash
+./Konduit-*-x86_64.AppImage
+```
+
+No installation required. The AppImage is self-contained.
+
+## 4. Load your config
+
+Your server administrator will provide a `client.toml` config file. On first launch, tap **Open config** and select the file.
+
+## 5. Privileges
+
+Konduit creates a TUN network device, which requires elevated network capability. The AppImage requests this automatically via a `pkexec` prompt on first run. If you see a password prompt, enter your user password to grant the capability.
+
+If `pkexec` is not available on your system (some minimal desktop environments), grant the capability manually once:
+
+```bash
+sudo setcap cap_net_admin=+ep ~/.local/share/konduit/konduit-helper
+```
+
+## 6. Autostart on login (optional)
+
+To start Konduit automatically when you log in, enable autostart in the app: **Settings → Start on login**.
+
+Alternatively, copy the provided desktop entry to your autostart directory:
+
+```bash
+cp ~/.local/share/applications/konduit.desktop ~/.config/autostart/
+```
+
+## Troubleshooting
+
+**AppImage won't launch** — your system may be missing FUSE. Install it:
+
+```bash
+# Debian / Ubuntu
+sudo apt install libfuse2
+
+# Fedora / RHEL
+sudo dnf install fuse
+```
+
+**"Failed to create TUN device"** — the capability was not granted. Run the `setcap` command from step 5 and relaunch.
+
+**Config not found on relaunch** — the app remembers the last config path. If you move the file, use **Open config** again to reselect it.

docs/gui-quickstart-windows.md

@@ -0,0 +1,62 @@
+# Konduit GUI — Windows Quickstart
+
+## Requirements
+
+- Windows 10 or later (64-bit)
+- Administrator account (required for VPN driver installation)
+
+## 1. Download
+
+Download `konduit-gui-*-windows-x86_64.zip` from the [Releases](../../releases) page.
+
+## 2. Extract
+
+Right-click the zip file and choose **Extract All**. Extract to a folder of your choice, for example `C:\Konduit`.
+
+Keep all files together — `Konduit.exe` and `wintun.dll` must be in the same folder.
+
+## 3. Run
+
+Double-click `Konduit.exe`.
+
+Windows will show a **UAC prompt** asking for administrator permission. This is required because Konduit uses the [WinTun](https://www.wintun.net/) driver to create a virtual network adapter. Click **Yes** to continue.
+
+> If you dismiss the UAC prompt, Konduit will not be able to establish a VPN connection.
+
+## 4. Load your config
+
+Your server administrator will provide a `client.toml` config file. On first launch, tap **Open config** and select the file.
+
+## 5. Connect
+
+Press **Connect**. A system tray icon will appear while the VPN is active. Right-click the tray icon to disconnect.
+
+## 6. Windows Defender / antivirus warning
+
+Some antivirus tools flag `wintun.dll` or new unsigned executables. If Windows Defender blocks the launch:
+
+1. Open **Windows Security → Virus & threat protection**
+2. Click **Protection history**
+3. Find the Konduit entry and choose **Allow**
+
+Alternatively, add the Konduit folder to your antivirus exclusion list.
+
+## 7. Autostart on login (optional)
+
+To start Konduit automatically when Windows starts, enable it in the app: **Settings → Start on login**.
+
+Alternatively, create a shortcut to `Konduit.exe` and place it in your Startup folder:
+
+```
+Win + R → shell:startup → paste shortcut here
+```
+
+## Troubleshooting
+
+**UAC prompt does not appear / app closes immediately** — make sure you are running as a user with administrator privileges. Standard (non-admin) accounts cannot install the WinTun driver.
+
+**"wintun.dll not found"** — `Konduit.exe` and `wintun.dll` must be in the same folder. Do not move them separately.
+
+**Connection fails immediately** — check that your `client.toml` points to the correct server address and port. Contact your server administrator if you are unsure.
+
+**Tray icon disappears unexpectedly** — the app may have crashed. Check Windows Event Viewer or relaunch `Konduit.exe`.

docs/privacy-policy.md

@@ -0,0 +1,72 @@
+# Konduit Privacy Policy
+
+_Last updated: 9 June 2026_
+
+## Who we are
+
+Konduit is a TCP-native VPN client developed and distributed by **[K-Ops Oy](https://k-ops.eu)**. Questions about this policy can be sent to: **[konduit@k-ops.eu](mailto:konduit@k-ops.eu)**
+
+## What data Konduit processes
+
+### On your device
+
+The Konduit client stores the following data locally:
+
+| Data | Purpose | Where it is stored |
+|------|---------|-------------------|
+| VPN server address and port | Connect to your VPN server | Local config file |
+| Peer ID and pre-shared key (PSK) | Authenticate with your VPN server | Local config file |
+| Session statistics (bytes sent/received, connection state) | Display connection status | In-memory only, not persisted |
+
+### On the VPN server
+
+When you connect, the VPN server you connect to processes:
+
+| Data | Purpose |
+|------|---------|
+| Your IP address | Route return traffic to your device |
+| Connection timestamps | Session management |
+| Traffic volume (bytes in/out) | Capacity planning and abuse prevention |
+| Destination IP addresses of tunnelled traffic | Route packets to their destination |
+
+The content of tunnelled traffic is not inspected beyond what is necessary for routing.
+
+## What we do not collect
+
+- Konduit does **not** collect analytics, crash reports, usage statistics, or any telemetry.
+- Konduit does **not** display advertising.
+- Konduit does **not** sell or share connection metadata with third parties.
+
+## Self-hosted deployments
+
+Konduit is designed to be self-hosted. If you run your own Konduit server, all server-side data listed above stays under your control and is never transmitted to [K-Ops Oy](https://k-ops.eu).
+
+## Data retention and deletion
+
+All client-side data is stored in the local config file. To delete it, remove your configuration or uninstall Konduit.
+
+Server-side connection logs are retained for a limited period for operational purposes and then deleted. The exact retention period depends on the server operator.
+
+## Security
+
+- All traffic between client and server is encrypted using **X25519** key exchange and **ChaCha20-Poly1305** AEAD.
+- The pre-shared key (PSK) is stored in the local config file with permissions restricted to the current user.
+- Stealth mode wraps the tunnel in a protocol that is indistinguishable from HTTPS, preventing deep-packet inspection from identifying Konduit traffic.
+
+## Children
+
+Konduit is not directed at children under 13 and does not knowingly collect data from children.
+
+## GDPR (EU residents)
+
+When using a [K-Ops Oy](https://k-ops.eu) operated server, [K-Ops Oy](https://k-ops.eu) acts as data processor for connection metadata (IP address, timestamps, traffic volume) as described above. This data is processed on the legal basis of legitimate interest (providing the VPN service). You may request deletion of your connection metadata by contacting **[konduit@k-ops.eu](mailto:konduit@k-ops.eu)**.
+
+When using a self-hosted server, [K-Ops Oy](https://k-ops.eu) does not process any of your data.
+
+## Changes to this policy
+
+If we update this policy, the new version will be published at this URL with an updated "Last updated" date.
+
+## Contact
+
+Privacy questions: **[konduit@k-ops.eu](mailto:konduit@k-ops.eu)**

docs/server-quickstart.md

@@ -62,7 +62,12 @@ Without this, konduit picks the first available `tunN`, which shifts if other VP
 ./konduit-server --config server.toml
 ```
 
-For persistent operation, use the provided systemd unit (`setup/server/konduit-server.service`).
+For persistent operation, use the provided systemd units in [docs/systemd/](systemd/). Copy `konduit-server.service` to `/etc/systemd/system/`, then:
+
+```bash
+sudo systemctl daemon-reload
+sudo systemctl enable --now konduit-server
+```
 
 ## 6. NAT / Masquerade
 

docs/systemd/konduit-server.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=Konduit Server
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/konduit
+ExecStart=/opt/konduit/konduit-server -c /opt/konduit/server.toml
+Restart=on-failure
+RestartSec=5
+
+# Optional hardening
+NoNewPrivileges=true
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target

docs/systemd/konduit.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=Konduit Client
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/konduit
+ExecStart=/opt/konduit/konduit -c /opt/konduit/client.toml
+Restart=on-failure
+RestartSec=5
+
+# Optional hardening
+NoNewPrivileges=true
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target