// the find
mmalmi/nostr-vpn
A Tailscale-like mesh VPN that uses Nostr keypairs for identity and relay signaling instead of a central coordination server. The data plane is WireGuard-backed via the FIPS library. Targets developers who want a self-sovereign mesh network without trusting a third-party control plane.
The Nostr-as-control-plane idea is technically interesting and solves the coordination problem without a central server — your identity is a keypair, not an account on someone's SaaS. The codebase shows real engineering discipline: UniFFI bridge for sharing Rust core across iOS/Android/desktop, Docker-based e2e tests for the tunnel stack, and a proper release gate script rather than just tagging and hoping. Platform coverage is broader than most side projects — macOS (SwiftUI), Linux (GTK/libadwaita), Windows (WPF), Android (Kotlin), and iOS all share the same Rust core. The relay-assisted fallback routing when direct UDP is blocked is a practical necessity that they've actually shipped, not just planned.
Android VPN runtime is explicitly 'still being hardened' and iOS TestFlight is not publicly accessible yet — so two of the five platforms are incomplete, which matters if you're evaluating this for anything mobile-facing. The canonical repo is at git.iris.to over an htree:// protocol most developers have never heard of, with GitHub as a mirror; that's a real friction point for contributors and means the GitHub issue tracker is probably not where decisions happen. There's no audit of the FIPS library itself linked anywhere — it's treated as a trusted dependency but the security model of the whole thing rests on it. The invite-based network model with 'one active network at a time' is a significant UX constraint that Tailscale doesn't have and is likely to frustrate anyone running multiple separate networks.