Nostr VPN

Use the nvpn CLI for private networking without a VPN provider account. Every device retains its own identity; network membership still needs an administrator's approval. This workflow does not require paid exits.

Establish the execution context

• Run nvpn --version, nvpn join-requests --help, and nvpn join-request --help. CLI approval and JSON join-request output are currently source-only and have not yet shipped in a release. Install a matching binary from https://github.com/mmalmi/nostr-vpn/releases/latest or use cargo install nvpn. Check the release's supported architecture.
• Choose an explicit, persistent absolute config path and pass --config on every command, including elevated ones. Reuse a designated profile; never overwrite an existing one with init --force.
• A Linux tunnel needs network privileges, /dev/net/tun, and iproute2; containers need NET_ADMIN and the TUN device. macOS/Windows need elevated platform networking setup. A cloud terminal or plugin does not confer this access. If unavailable, report that specific limitation and use an authorized machine with those capabilities.
• Persist config and key sidecars privately. Give separate devices separate keys. Do not print private keys, copy the admin identity to a joining device, or put join links into public output.

Create or join

On a new admin host, run nvpn init --config "$NVPN_CONFIG", then use the printed public nostr_pubkey with nvpn set --config "$NVPN_CONFIG" --device "$ADMIN_DEVICE_ID". Start it with nvpn start --config "$NVPN_CONFIG" --daemon --connect.