c61664ca70
Audit of the public repo against the actual server and konduit-ctl source. The happy path was documented; the failure modes were not. - server.toml had no reference at all. Add docs/server-config.md covering every key, [tls], the control API, and key handling. - The mantra could not recover the identity key on its own: derive_from_passphrase needs the [kdf] salt, which is 32 random bytes generated once at bootstrap. bootstrap says so in the file it generates (core/src/config.rs:403); the quickstart claimed the opposite. Fixed, with a backup step added before it is needed rather than after. - konduit-server never appeared in a download step, yet konduit-server.service expects /opt/konduit/konduit-server - a path no instruction created. Added the install section and moved setcap after the copy, since capabilities do not survive every cross-filesystem copy and a binary that silently lost cap_net_bind_service fails at bind time. - Hot config reload was a headline feature with no documented mechanism. It is a control API on 127.0.0.1:3001, and add-client only edits the file on disk, so a new peer is not live until something reloads it. Documented, including that /reload does not disconnect revoked peers but /sync does. - [tls] native termination was entirely undocumented; the key must be PKCS#8. - Dropped a README claim about a konduit-admin-ui unit that does not exist, and fixed a systemd copy path that only resolved if this repo had been cloned to /opt/konduit. #k-ops/#1/#211
62 lines
1.6 KiB
Markdown
62 lines
1.6 KiB
Markdown
# Konduit CLI Client Quickstart
|
|
|
|
## 1. Download
|
|
|
|
Download the `konduit` binary from the [Releases](../../releases) page and make it executable:
|
|
|
|
```bash
|
|
chmod +x konduit
|
|
sudo cp konduit /opt/konduit/konduit
|
|
```
|
|
|
|
## 2. Get a client config
|
|
|
|
Your server administrator will provide a `client.toml` generated by `konduit-ctl add-client`. Transfer it to the client machine:
|
|
|
|
```bash
|
|
sudo cp client.toml /opt/konduit/client.toml
|
|
sudo chmod 600 /opt/konduit/client.toml
|
|
```
|
|
|
|
## 3. Connect
|
|
|
|
```bash
|
|
/opt/konduit/konduit -c /opt/konduit/client.toml
|
|
```
|
|
|
|
A successful connection looks like:
|
|
|
|
```
|
|
→ resolving vpn.example.com ok
|
|
→ tcp handshake X25519 ok
|
|
→ tun device konduit0 up
|
|
→ routes applied by server policy ok
|
|
connected · no udp, no root, port 443
|
|
```
|
|
|
|
## 4. Run as a systemd service
|
|
|
|
To connect automatically on boot, use the provided systemd unit:
|
|
|
|
```bash
|
|
# konduit.service ships in this repo at docs/systemd/ — copy it from the repo root
|
|
sudo cp docs/systemd/konduit.service /etc/systemd/system/
|
|
sudo systemctl daemon-reload
|
|
sudo systemctl enable --now konduit
|
|
```
|
|
|
|
The unit expects the binary at `/opt/konduit/konduit` and the config at
|
|
`/opt/konduit/client.toml` — edit both paths if you installed elsewhere.
|
|
|
|
The unit runs as root (required for TUN device creation) and restarts automatically on failure.
|
|
|
|
## 5. Capabilities (alternative to root)
|
|
|
|
To run without root, grant the binary the required capability instead:
|
|
|
|
```bash
|
|
sudo setcap cap_net_admin=+ep /opt/konduit/konduit
|
|
```
|
|
|
|
Then change `User=root` to your user account in the systemd unit before enabling it.
|