NexaPipe 0.5.0

Downloads

Client app first, then the server. Nothing needs an account, and nothing is gated.

Desktop & mobile app — nexa

One APK per ABI: arm64-v8a for every phone, x86_64 for the emulator images a development machine can run. Desktop bundles are signed with the Tauri updater key; the in-app updater reads latest.json in the same release. iOS is not a supported platform — see the roadmap.

Checksums for every asset above: SHA256SUMS.txt.

Server & client library — nexapipe

Each archive holds the nexapipe binary, the client cdylib for embedding, config.toml.2fa.example, the README and the licence. Checksums for every asset above: SHA256SUMS.txt.

Container image

New in this release: the image is published with everything else, as one multi-arch manifest for linux/amd64 and linux/arm64.

# This release exactly
docker pull ghcr.io/open-nexa/nexapipe:0.5.0

# The newest stable release (:latest never points at a pre-release)
docker pull ghcr.io/open-nexa/nexapipe:latest

docker-compose.yaml names the published image, so docker compose up pulls it rather than building — --build still builds locally under the same name.

Install from a terminal

No package manager yet — these are the release assets, straight from the tag.

# Linux x86_64, static binary
curl -LO https://github.com/open-nexa/nexapipe/releases/download/v0.5.0/nexapipe-0.5.0-x86_64-unknown-linux-musl.tar.gz
tar -xzf nexapipe-0.5.0-x86_64-unknown-linux-musl.tar.gz
cd nexapipe-0.5.0-x86_64-unknown-linux-musl && ./nexapipe --version

# macOS, Apple silicon
curl -LO https://github.com/open-nexa/nexapipe/releases/download/v0.5.0/nexapipe-0.5.0-aarch64-apple-darwin.tar.gz
tar -xzf nexapipe-0.5.0-aarch64-apple-darwin.tar.gz
cd nexapipe-0.5.0-aarch64-apple-darwin && ./nexapipe --version

# Linux — verify before extracting: the check looks for the archive beside
# SHA256SUMS.txt, so it has to run before the cd into the directory
curl -LO https://github.com/open-nexa/nexapipe/releases/download/v0.5.0/SHA256SUMS.txt
sha256sum -c --ignore-missing SHA256SUMS.txt

# macOS — the same check with shasum, which is what ships there. macOS 26
# added sha256sum, but every release older than that has only shasum, and not
# every version of it understands --ignore-missing, so grep narrows the list
# to the one archive you actually downloaded. Still before the cd.
curl -LO https://github.com/open-nexa/nexapipe/releases/download/v0.5.0/SHA256SUMS.txt
grep nexapipe-0.5.0-aarch64-apple-darwin.tar.gz SHA256SUMS.txt | shasum -a 256 -c -

All assets: SHA256SUMS.txt.

What's new

0.5.0 follows 0.4.0, released 30 September 2026. No configuration key changes, and nothing stopped working that used to — but a passthrough or tcp route whose backend refuses connections is now reported unhealthy where it previously looked fine.

Health decides which node gets the next request

• 0.4.0 started probing the nodes and writing down what came back; nothing read those records. The balancer still picked by index into a list nothing could change, so a node dead for an hour kept receiving its share of the traffic.
• Selection takes one flag per candidate now and answers Option<usize>, so "none of them" is a sayable answer — index 0 was always a valid reply to "which node", which is why the old code could never say no.
• A request that fails to dial marks the node down where it noticed, rather than waiting up to thirty seconds for the probe to find out.
• A single node that is down is still dialled, because refusing to dial the only node turns "down" into "no service at all" for a deployment with nothing to fail over to.

The backends that cannot answer GET /health

• Only routes serving http were probed. A TLS listener behind a passthrough route had no health at all: it surfaced as a connect error on whichever flow happened to try it first.
• passthrough and tcp routes are probed by connecting to them — a TLS backend by completing its handshake. That is deliberately the smaller claim: something is listening, not that it works.
• A udp-only route is still not probed, now for a stated reason: every probe available is one every backend would fail, and a pool emptied by a check that could never have succeeded is worse than an unchecked one.

What each node carried, and whether it answered

• The server exposes nexapipe_traffic_bytes_total{direction="sent"|"received"}, and /v1/status carries the same two numbers. They are counted on the client leg and nowhere else — the one place where one number means one thing across paths this different. An HTTP response takes its count from what the access log already printed, so the log line and the Prometheus number cannot disagree.
• The desktop lists each node's health beside its traffic: whether it answered the last probe, how long it has been unreachable, and how much it has carried. The Android notification shows live up and down rates.
• What is counted is tunnel payload: no protocol headers, nothing discarded, and nothing counted twice — the TUN interface pump is deliberately not instrumented.

Desktop: the whole Config page stands behind the door

• In 0.4.0 the operating system was asked before one credential was revealed. Now it is asked before the page renders at all: no node list, no connection strings, no two-factor secrets, no relay. A shut page puts none of it in the document.
• A press that does nothing says why. Being refused used to come back as "the door is shut", which the UI read as its own instruction to stay quiet — so a wrong password, a dismissed prompt or a failed fingerprint left the page exactly as it had been.
• The relay settings moved from Settings to Config, behind the same door: which relay this machine dials is part of how it connects, and a custom relay's bearer token is a credential.
• macOS stopped using the keychain. Its access prompt is what turned one unlock into two sheets, and what once left a locked page with no way out; the master key now lives in the same 0600 file the other platforms fall back to, and is moved rather than replaced, so nothing already stored becomes unreadable.
• Five smaller fixes came with it: a failed PAM check says so in the dialog instead of arriving seconds later; copies go through the operating system's clipboard rather than the asynchronous API WebKit refuses without focus; the spinner survives Reduce Motion; macOS stopped drawing a second title bar above the app's own.

Desktop: the machine's DNS no longer outlives the tunnel

• Three separate gaps each leaked on their own. A run that died before its teardown left the system DNS pointed at the TUN with nothing to undo it at the next start — on macOS and Linux there was no self-heal at all.
• Quitting skipped the restore entirely: nothing handled the exit events, so Cmd+Q left the machine pointed at a tunnel that no longer existed.
• The Unix service process had no signal handling whatsoever, so launchctl unload, systemctl stop and the shutdown broadcast all just killed it. Windows was the only platform doing this correctly; it now has graceful shutdown, an explicit launchd ExitTimeOut, and a Windows service entry point that matches what the nexa-service binary already did.
• Only the …254 host address of a candidate block counts as ours, never the /24 around it: 10.0.0.0/24 is both a candidate block and the subnet a great many home LANs use.

Distribution: an image, and your own relay

• The release publishes ghcr.io/open-nexa/nexapipe — one multi-arch manifest, linux/amd64 and linux/arm64 — under the same tag that already drives the archives, the bundles and the APK.
• docs/self-hosted-relay.md takes a relay from nothing to running, and how to point NexaPipe at it. It does not remove the third-party dependency — only changes whom you depend on.

Also in this release

• The root workspace is compiled on Windows in CI, which it never was — only the desktop crate had a Windows job. Check only, no tests: the integration tests spawn the binary and reach for cfg(unix) fixtures.
• The credential gates have both been driven by hand on macOS, Windows and Linux, and past BiometricPrompt on a real Android device. Nothing about the designs changed; what changed is that 0.4.0's note no longer has to say it might not work.

Changelog

Added

• Client: the health map decides which node the next request goes to, and a failed dial writes to it where the failure was noticed.
• Server: passthrough and tcp routes get a TCP connect probe, a TLS backend one that completes its handshake.
• Server: nexapipe_traffic_bytes_total and a traffic object on /v1/status.
• Client, desktop and Android: per-node byte counters, a desktop node-health view, and live transfer rates in the Android notification.
• Release: a container image published to GHCR alongside the archives.
• docs/self-hosted-relay.md.

Changed

• Desktop: the whole Config page renders only while the operating system has confirmed the user, and the relay settings moved into it from Settings.
• macOS: the credential store's master key lives in a 0600 file rather than the keychain, and is migrated out of it on first launch.
• Service shutdown is graceful on every platform rather than one: UNIX signals are handled instead of killing the process, and DNS restore, self-heal and exit hooks exist on all three rather than on Windows alone.
• CI: the root workspace is compiled on Windows.

Fixed

• Desktop: disconnecting, quitting or uninstalling no longer leaves the machine's DNS pointed at a tunnel that is gone — across every exit path, on every platform.
• Desktop: a password the operating system did not accept said nothing; it now says whether the password was wrong or the device did not confirm.
• Desktop: a copy made just after the OS prompt came back as "could not copy", because the clipboard API refuses a document that lost focus while the prompt was up.
• Desktop: the loading spinner never turned with Reduce Motion on, and macOS ran a system title bar above the app's own.
• Server: an invalid health-check path panicked instead of failing the probe.

Before upgrading

• No configuration key changed and no default moved. A config.toml that works on 0.4.0 loads unchanged on 0.5.0.
• passthrough and tcp routes are probed now. A backend that refuses TCP connections will be reported unhealthy and, in a multi-backend route, skipped — where it previously looked healthy and failed on the request.
• /metrics gains a counter and loses nothing; /v1/status gains a traffic object.
• Desktop (macOS): the master key moves out of the keychain on first launch. It is moved rather than replaced, so every credential already in the store stays readable — and macOS stops asking whether the app may read the keychain.
• Desktop: opening Config asks the machine to confirm you before it shows anything. Two minutes still covers everything after it.
• Docker: docker-compose.yaml names the published image, so docker compose up pulls instead of building. Pin :0.5.0 rather than :latest if you want the version to stay put.
• Downgrading the desktop app still means re-importing the invite, as it did in 0.4.0: a node's connection string moved into the encrypted store, and an older build finds nothing and drops the node.