NexaPipe 0.6.1

Downloads

Client app first, then the server. Nothing needs an account, and nothing is gated.

Desktop & mobile app — nexa

One APK per ABI: arm64-v8a for every phone, x86_64 for the emulator images a development machine can run. Desktop bundles are signed with the Tauri updater key; the in-app updater reads latest.json in the same release. iOS is not a supported platform — see the roadmap.

Checksums for every asset above: SHA256SUMS.txt.

Server & client library — nexapipe

Each archive holds the nexapipe binary, the client cdylib for embedding, config.toml.2fa.example, the README and the licence. Checksums for every asset above: SHA256SUMS.txt.

Container image

Published with everything else, as one multi-arch manifest for linux/amd64 and linux/arm64. Both READMEs carry a systemd unit for the server now as well.

# This release exactly
docker pull ghcr.io/open-nexa/nexapipe:0.6.1

# The newest stable release (:latest never points at a pre-release)
docker pull ghcr.io/open-nexa/nexapipe:latest

docker-compose.yaml names the published image, so docker compose up pulls it rather than building — --build still builds locally under the same name.

Install from a terminal

No package manager yet — these are the release assets, straight from the tag.

# Linux x86_64, static binary
curl -LO https://github.com/open-nexa/nexapipe/releases/download/v0.6.1/nexapipe-0.6.1-x86_64-unknown-linux-musl.tar.gz
tar -xzf nexapipe-0.6.1-x86_64-unknown-linux-musl.tar.gz
cd nexapipe-0.6.1-x86_64-unknown-linux-musl && ./nexapipe --version

# macOS, Apple silicon
curl -LO https://github.com/open-nexa/nexapipe/releases/download/v0.6.1/nexapipe-0.6.1-aarch64-apple-darwin.tar.gz
tar -xzf nexapipe-0.6.1-aarch64-apple-darwin.tar.gz
cd nexapipe-0.6.1-aarch64-apple-darwin && ./nexapipe --version

# Linux — verify before extracting: the check looks for the archive beside
# SHA256SUMS.txt, so it has to run before the cd into the directory
curl -LO https://github.com/open-nexa/nexapipe/releases/download/v0.6.1/SHA256SUMS.txt
sha256sum -c --ignore-missing SHA256SUMS.txt

# macOS — the same check with shasum, which is what ships there. macOS 26
# added sha256sum, but every release older than that has only shasum, and not
# every version of it understands --ignore-missing, so grep narrows the list
# to the one archive you actually downloaded. Still before the cd.
curl -LO https://github.com/open-nexa/nexapipe/releases/download/v0.6.1/SHA256SUMS.txt
grep nexapipe-0.6.1-aarch64-apple-darwin.tar.gz SHA256SUMS.txt | shasum -a 256 -c -

All assets: SHA256SUMS.txt.

What's new

0.6.1 follows 0.6.0, released 11 October 2026. Two configuration keys are added and none is removed, so a config.toml that works on 0.6.0 still loads — but five things behave differently without being configured to, and all of them are listed under before upgrading.

First run writes a config and an identity

• Start the server with no config.toml and it writes a minimal one — [auth] enabled = true, no plaintext listener, no routes — so a fresh operator has something to edit rather than an error to decode.
• Start with a config that has no [iroh] secret_key and the server generates one and writes it back, so the endpoint's Node ID survives a restart without running --generate-secret by hand.
• A key that does not parse refuses the start; a config that cannot be written still starts, on a throwaway identity, with a warning — a read-only mount is an ordinary deployment.

[iroh] credentials can live outside config.toml

• secret_key_file and relay_auth_token_file point at a separate 0600 file holding the value; NEXAPIPE_IROH_SECRET_KEY and NEXAPIPE_RELAY_AUTH_TOKEN do the same from the environment.
• Sources rank env → file → inline, and naming more than one source for a credential is refused at load rather than silently picked — a config that disagrees with itself is a deployment mistake.
• The credential sidecar files stay enforced 0600 on Unix — only the config file's own mode is no longer checked (see below).

A secrets-directory path with no [iroh] table

• NEXAPIPE_IROH_SECRET_KEY_FILE names the key file by absolute path, taken literally rather than relative to the config directory. A missing env-named file is generated into on first start (0600 on Unix), and the key is never written back into config.toml.
• The environment credentials apply even when the config has no [iroh] table at all. The docker compose setup now mounts ./secrets at /app/secrets and wires the variable to /app/secrets/iroh.key; back that directory up together with config/.

Config-file permissions are no longer gated

• The server used to refuse to start — and a reload could not turn 2FA on — when config.toml was group- or world-reachable and held a credential. That gate is gone, so a 0644 bind mount starts: the ordinary Docker arrival mode.
• The trade-off is on the operator — any account that can read the file can copy every credential in it. chmod 600 remains recommended, and the generated first-run file is still written 0600.

A Docker-friendly default config path

• The default --config path is now ./config/config.toml (was ./config.toml), matching the docker bind-mount target.
• NEXAPIPE_CONFIG_DIR shifts that default to <dir>/config.toml. The docker setup sets it to /app/config, so the container picks up the operator's file by default. --config always wins.

Changelog

One line each; the full entry is in CHANGELOG.md.

Added

• Server: a first start with no config.toml writes a minimal one; a config with no [iroh] secret_key gets one generated and written back.
• Server: [iroh] secret_key_file and relay_auth_token_file point at a separate 0600 file; NEXAPIPE_IROH_SECRET_KEY and NEXAPIPE_RELAY_AUTH_TOKEN carry the value from the environment.
• Server: NEXAPIPE_IROH_SECRET_KEY_FILE names the key file by path — created on first start if missing — and the environment credentials now apply with no [iroh] table; the compose setup mounts ./secrets at /app/secrets/iroh.key.

Changed

• Server: config.toml permission checks at start and on reload are removed — a 0644 bind mount starts; the credential sidecar files stay enforced 0600.
• Server: the default --config path is now ./config/config.toml, and NEXAPIPE_CONFIG_DIR shifts that default.
• Docs: the invite QR code renders with correct line spacing on macOS.

Fixed

• Android: nativeStopTunProxy and the ndk_context import are now gated on target_os = "android", so a host build with --features tun-proxy no longer fails to link.

Before upgrading

• Two configuration keys are added and none is removed or renamed: a config.toml that works on 0.6.0 still loads on 0.6.1.
• The default --config path moves from ./config.toml to ./config/config.toml. If you launch the server with no --config flag, move your file into config/ or pass --config config.toml explicitly. Docker users who set NEXAPIPE_CONFIG_DIR=/app/config need no change.
• A permissive config.toml no longer refuses to start. If you relied on the server refusing a group- or world-readable config holding credentials, that check is gone — keep the file private (chmod 600) or move the credentials to a sidecar file or the environment. The sidecar files themselves are still checked.
• A config with no [iroh] secret_key now gets one generated on first start and written back. If you relied on a fresh Node ID per restart, set NEXAPIPE_NO_PERSIST_IDENTITY=1.
• A [iroh] secret_key that does not parse now refuses the start instead of warning and using a throwaway identity. Verify your key parses before upgrading.
• Naming more than one source for a credential — e.g. secret_key and secret_key_file at once, or the key both in NEXAPIPE_IROH_SECRET_KEY and the config — is refused at load. Remove the duplicate before upgrading.
• Docker: pin :0.6.1 rather than :latest if you want the version to stay put.