Files

E. Kaparulin c61664ca70 docs: correct the self-hosted server path and document server.toml

Audit of the public repo against the actual server and konduit-ctl source.
The happy path was documented; the failure modes were not.

- server.toml had no reference at all. Add docs/server-config.md covering
  every key, [tls], the control API, and key handling.
- The mantra could not recover the identity key on its own:
  derive_from_passphrase needs the [kdf] salt, which is 32 random bytes
  generated once at bootstrap. bootstrap says so in the file it generates
  (core/src/config.rs:403); the quickstart claimed the opposite. Fixed, with
  a backup step added before it is needed rather than after.
- konduit-server never appeared in a download step, yet
  konduit-server.service expects /opt/konduit/konduit-server - a path no
  instruction created. Added the install section and moved setcap after the
  copy, since capabilities do not survive every cross-filesystem copy and a
  binary that silently lost cap_net_bind_service fails at bind time.
- Hot config reload was a headline feature with no documented mechanism. It
  is a control API on 127.0.0.1:3001, and add-client only edits the file on
  disk, so a new peer is not live until something reloads it. Documented,
  including that /reload does not disconnect revoked peers but /sync does.
- [tls] native termination was entirely undocumented; the key must be PKCS#8.
- Dropped a README claim about a konduit-admin-ui unit that does not exist,
  and fixed a systemd copy path that only resolved if this repo had been
  cloned to /opt/konduit.

#k-ops/#1/#211

2026-10-10 22:43:47 +03:00

1.6 KiB

Raw Blame History

Konduit CLI Client Quickstart

1. Download

Download the konduit binary from the Releases page and make it executable:

chmod +x konduit
sudo cp konduit /opt/konduit/konduit

2. Get a client config

Your server administrator will provide a client.toml generated by konduit-ctl add-client. Transfer it to the client machine:

sudo cp client.toml /opt/konduit/client.toml
sudo chmod 600 /opt/konduit/client.toml

3. Connect

/opt/konduit/konduit -c /opt/konduit/client.toml

A successful connection looks like:

→ resolving vpn.example.com  ok
→ tcp handshake  X25519  ok
→ tun device  konduit0  up
→ routes applied by server policy  ok
connected · no udp, no root, port 443

4. Run as a systemd service

To connect automatically on boot, use the provided systemd unit:

# konduit.service ships in this repo at docs/systemd/ — copy it from the repo root
sudo cp docs/systemd/konduit.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now konduit

The unit expects the binary at /opt/konduit/konduit and the config at /opt/konduit/client.toml — edit both paths if you installed elsewhere.

The unit runs as root (required for TUN device creation) and restarts automatically on failure.

5. Capabilities (alternative to root)

To run without root, grant the binary the required capability instead:

sudo setcap cap_net_admin=+ep /opt/konduit/konduit

Then change User=root to your user account in the systemd unit before enabling it.

1.6 KiB Raw Blame History