4a4ab9d781
Three defects in the README, all found while cross-checking it against the
source and the published releases.
## 1. The key-storage claim was false, not merely wrong about platforms
"Private keys are stored in the OS secure enclave on every platform (iOS
Keychain, macOS Keychain, Android Keystore). They are never written to disk
in plaintext."
There is no OS-keychain integration in Konduit at all. Nothing in the Rust
workspace or the Flutter GUI references a keyring or secure-storage crate --
the GUI's only persistence dependency is shared_preferences. And
core/src/config.rs writes the client identity key straight into the config
file the docs tell you to pass with --config:
client.toml: identity_key = "<hex>"
so "never written to disk in plaintext" was false by construction, for the
one thing the claim was about. It also named two platforms that do not ship.
Replaced with what actually happens, and the consequence: the key is
generated locally, never sent to K-Ops, and the config file is itself the
secret -- so restrict its permissions, do not commit it, do not paste it
into a bug report. Deliberately not reworded into another claim I could not
verify.
## 2. The CLI example does not run
./konduit connect --config client.toml
--config is a top-level flag on Args (cli/src/main.rs:15), not on the
Connect subcommand, and it is not marked global, so clap rejects it:
error: unexpected argument '--config' found
Fixed to `./konduit --config client.toml`, which is the form
docs/client-quickstart.md uses and the binary accepts. Documented the
`connect` subcommand's actual flags --server/--peer-id/--identity/
--server-pub -- checked against `konduit connect --help`.
## 3. The artifact table lists assets that are not in the current release
Checked against the Gitea releases API rather than the Makefile. v0.1.0-beta.11
ships five assets: the AppImage, the three Linux binaries, and
konduit-gui-...-windows-x86_64-portable.zip. It has no Windows CLI zip and
no Android AAB; beta.9 and beta.10 had both, and the Windows GUI zip was
only named -portable.zip in beta.11.
So the Windows GUI row is now the published name, and the two rows that
appear in some releases but not others are marked as such with the
variation spelled out. The Releases page is called authoritative, since
which assets ship is a per-release decision.
No claim here is reworded from assumption -- each one was checked against
the code or the published release first.
6.7 KiB
TCP-Native VPN. Works Where UDP Doesn't.
Konduit is a modern VPN built around a single principle: TCP transport that works when UDP is blocked.
WireGuard is excellent — until your ISP throttles or blocks UDP. Konduit solves that without the complexity of OpenVPN or the fragility of UDP-wrapping hacks. It runs fully in userspace, requires no elevated privileges, and gets out of your way.
Why Konduit?
Most VPNs treat TCP as a fallback. Konduit is designed for TCP from the ground up, which means:
- No HEAD-OF-LINE blocking from tunneling UDP into TCP
- Reliable behaviour on restrictive corporate and mobile networks
- WireGuard-level simplicity without the UDP dependency
Features
- TCP-native protocol — designed for TCP, not retrofitted
- Server-controlled routing — administrators enforce routing policy; clients cannot bypass it
- Userspace implementation — no kernel modules, no root required
- Hot config reload — update server configuration without dropping connections
- QR code provisioning — scan once, connect instantly
- Cross-platform — Linux, Windows, Android (macOS and iOS coming soon)
- Modern cryptography — X25519 key exchange, ChaCha20-Poly1305 data channel
- SOCKS5 chaining — egress-dial (
use_proxy) to reach the server through your own proxy, or a post-tunnel listener (listen_socks) for per-app routing — see SOCKS Modes - Memory safe — written entirely in Rust
Download
Releases are published on the Releases page. Each release includes:
| Artifact | Platform | Purpose |
|---|---|---|
konduit-server-*-linux-x86_64 |
Linux | VPN server |
konduit-*-linux-x86_64 |
Linux | CLI client |
konduit-ctl-*-linux-x86_64 |
Linux | Server provisioning tool |
Konduit-*-x86_64.AppImage |
Linux | GUI client (AppImage) |
konduit-gui-*-windows-x86_64-portable.zip |
Windows | GUI client |
konduit-cli-*-windows-x86_64.zip |
Windows | CLI client + wintun.dll — not in every release |
konduit-*-android.aab |
Android | Android app for bundletool sideload — not in every release |
Which Windows and Android assets are attached varies between releases: v0.1.0-beta.9
and v0.1.0-beta.10 carried both, v0.1.0-beta.11 shipped the Windows GUI zip only (as
-portable.zip). The Releases page is authoritative — check it
rather than assuming a row is present. Android is on Google Play either way.
Linux (CLI)
# Download konduit and konduit-ctl from the Releases page, then:
chmod +x konduit konduit-ctl
# Bootstrap a server
echo "your secret mantra" | ./konduit-ctl bootstrap -l vpn.example.com:443 -p -
# Connect a client
./konduit --config client.toml
--config/-c is a top-level flag, not a connect flag. The connect
subcommand takes the peer details individually instead:
./konduit connect --server vpn.example.com:443 \
--peer-id <peer-id> --identity <key-hex> --server-pub <server-pub-hex>
Linux (GUI)
Download the .AppImage, make it executable, and run it:
chmod +x Konduit-*-x86_64.AppImage
./Konduit-*-x86_64.AppImage
Windows
Extract the zip and run konduit.exe (CLI) or Konduit.exe (GUI). wintun.dll must remain alongside the executable.
Android
Download from Google Play or sideload the .aab using bundletool.
macOS · iOS
Coming soon.
Setup
GUI clients
- Linux GUI Quickstart — AppImage, privileges, autostart
- Windows GUI Quickstart — extract, UAC, WinTun, autostart
CLI & server
- Client Quickstart — download, configure, connect, run as a systemd service
- Server Quickstart — install, provision, NAT setup for iptables and firewalld
- SOCKS5 Modes — reach the server through a proxy, or expose a local SOCKS5 listener
- Connection Tuning — opt-in connection pooling for unstable links
- systemd units — service files for konduit-server, konduit (client), and konduit-admin-ui
Architecture
Flutter UI (Dart)
│
flutter_rust_bridge (FFI)
│
Konduit engine (Rust)
├── TUN device (userspace)
├── TCP tunnel protocol
├── Key exchange (X25519)
└── Route manager
| Layer | Technology |
|---|---|
| UI | Flutter / Dart |
| Core engine | Rust (Tokio async) |
| FFI bridge | flutter_rust_bridge |
| Cryptography | ring / rustls |
| TUN device | tun crate (userspace) |
Openness Model
The konduit-platform crate is published here for transparency and security audit. It contains the cryptographic primitives, connection statistics, and platform networking layer (TUN device, DNS, routes) — everything an auditor needs to verify what runs on your machine. It is licensed under the PolyForm Noncommercial License 1.0.0 — free to read, study, and use for noncommercial purposes.
The VPN server and management UI are proprietary. Source review under NDA is available for enterprise partners.
Security
No UDP dependency: Konduit does not require UDP at any layer.
Key handling: Your private identity key is generated locally by konduit-ctl and written into the client configuration file you pass with --config — it is never transmitted to K-Ops, and K-Ops operates no server. That file is the secret. Treat it like a private key file: readable only by its owner, and the only thing standing between an attacker and a tunnel into your VPN is its permissions. Do not commit it or paste it into a bug report.
Support
Bug reports: file an issue on Gitea Issues.
Vulnerabilities: report directly to konduit@k-ops.eu.
Contributing: Core development is handled internally. We do not currently accept external pull requests.
About
Created by Eugen Kaparulin.
Official binaries distributed by K-Ops Oy.
© Eugen Kaparulin. All rights reserved.
konduit-platform is published under the PolyForm Noncommercial License 1.0.0.
All other parts of Konduit are proprietary.
Privacy Policy