Skip to main content

What's new in version 0.2.4

Release Highlights​

Version 0.2.4 brings Linux native packages (deb + rpm), CLI authentication via device code flow, CLI mirror for headless servers, and systemd services for both the VPN daemon and client daemon.

New Features​

Linux Native Packages​

Camouflage is now available as native .deb and .rpm packages for x86_64 and ARM64:

  • Debian/Ubuntu — APT repository with GPG-signed packages
  • RHEL/Fedora — YUM/DNF repository
  • One-line installer — curl -sSL https://packages.camouflage.network/install.sh | sudo bash
  • Includes camouflage-daemon, camouflage-client, and camouflage-relay binaries
  • Systemd service files for automatic startup

CLI Device Code Authentication​

Headless Linux systems can now authenticate using a device code flow (similar to Docker login):

camouflage-client login

# Output:
# To authenticate, visit:
#     https://camouflage.network/activate
# and enter code:
#     A1B2-C3D4
# Waiting for authentication...

Open the URL on any device where you're logged into Camouflage Cloud, enter the code, and the CLI picks up the auth automatically.

CLI Mirror (Headless Linux)​

Mirror is now available on Linux via the CLI — no GUI required:

# Expose a local port
camouflage-client mirror 3000

# Specify protocol
camouflage-client mirror 3000 --protocol http

Systemd Services​

Two systemd services are included in Linux packages:

ServiceBinaryPurpose
camouflage.servicecamouflage-daemonVPN daemon (QUIC tunnel server)
camouflage-client.servicecamouflage-client daemonClient IPC daemon (auth storage, mirror)
# Enable and start both
sudo systemctl enable --now camouflage camouflage-client

Device Activation Page​

New /activate page in Camouflage Cloud for entering device codes from CLI login.

Technical Improvements​

  • Daemon-only auth storage — CLI auth tokens stored via daemon IPC (no file fallback), works consistently with and without sudo
  • Version-filtered package builds — RPM and deb build scripts correctly select the target version
  • 229 tests across the workspace

What's new in version 0.2.3

Release Highlights​

Version 0.2.3 introduces the Camouflage Hub — a unified launcher with multi-window architecture — along with Camouflage Mirror (reverse tunnels), Phantom Key (post-quantum crypto), client authentication, fixed IP assignment, and connection profile management.

New Features​

Camouflage Hub — Unified Launcher​

The desktop app is now a multi-product hub. Instead of a single VPN window, the app launches a compact hub that gives you quick access to all Camouflage products:

  • Silo — Zero Trust Networks (existing)
  • Lens — Network Monitor
  • Mirror — Expose & Tunnel
  • Phantom Key — Post-Quantum Crypto

Each product opens in its own dedicated window. The hub shows real-time status for every product at a glance with a command palette (Cmd+K) for quick navigation.

Camouflage Mirror — Expose & Tunnel​

Mirror lets you expose local services to the internet through secure reverse tunnels:

  • Expose localhost — Make local ports accessible via public URLs
  • Tunnel management — Create, monitor, and tear down tunnels from the UI
  • Session tracking — See active tunnels with connection stats

Phantom Key — Post-Quantum Crypto​

Hardware key management with post-quantum cryptography support. Ready for the next generation of encryption standards.

Client Authentication Gate​

The daemon now requires an auth key for every incoming connection. Unauthenticated clients are rejected immediately.

  • Enterprise mode: Auth keys validated against the backend API
  • Standalone mode: Auth keys managed via clients.toml local registry
  • Fallback: If the API is unreachable, the daemon falls back to clients.toml

Fixed IP Assignment​

Nodes now receive persistent IP addresses that survive reconnections and daemon restarts:

  • Each client is assigned a fixed IP when registered
  • The same IP is allocated on every reconnect
  • IPs are reserved even while the client is disconnected
  • Enterprise: IPs managed centrally via the backend API
  • Standalone: IPs stored in clients.toml

Daemon CLI Subcommands​

New management subcommands for standalone daemon administration:

# Register a new client
camouflage-daemon add-client --name "alice-laptop"

# Revoke access
camouflage-daemon revoke-client --auth-key "tskey-..."

# List all registered clients
camouflage-daemon list-clients

# Export a .camouflage connection profile
camouflage-daemon export-profile --auth-key "tskey-..." --server vpn.example.com:61700

Connection Profile Export & Import​

Generate portable .camouflage profile files (matching the desktop app format) and import them on the client side:

# Daemon: export profile
camouflage-daemon export-profile \
  --auth-key "tskey-..." \
  --server "vpn.example.com:61700" \
  --output alice.camouflage

# Client: import and connect
camouflage-client connect --profile alice.camouflage

Backend Node IP Endpoint​

New daemon API endpoint for enterprise deployments:

  • GET /api/vpn/networks/{id}/daemon/node-ip/?auth_key=tskey-...
  • Returns the node's assigned IP, name, status, and enabled flag
  • Used by the daemon to resolve fixed IPs from the central backend

Technical Improvements​

  • Multi-window architecture — Tauri v2 multi-webview with per-product windows and a shared hub
  • ClientManager module in camouflage-core — thread-safe client registry with atomic file writes
  • IpAllocator::allocate_specific() — reserve specific IPs instead of FIFO-only allocation
  • Auth gate in connection handler — priority-based resolution: API > clients.toml > reject
  • Profile import on CLI client — --profile flag parses .camouflage JSON and extracts all connection params
  • Windows support — Desktop app builds and runs on Windows
  • 215 tests across the workspace (up from 144)

Breaking Changes​

Auth Keys Now Required​

Standalone daemon deployments must register clients before they can connect. Previously, any client could connect without authentication.

Migration: Run camouflage-daemon add-client for each client that needs access, then distribute the generated auth keys or .camouflage profiles.

What's new in version 0.2.2

Release Highlights​

Version 0.2.2 introduces Camouflage Lens - a free network visibility tool that shows you every connection in your infrastructure.

New Features​

🔍 Camouflage Lens - Network Visibility​

Lens monitors your network traffic and shows you exactly what's happening:

  • Connection Tracking: See all network connections with app, destination, port, and protocol
  • Process Resolution: Know which application is making each connection
  • Hostname Detection: DNS cache and TLS SNI parsing for human-readable destinations
  • Real-time Monitoring: Watch connections as they happen
  • Export to CSV: Download your connection data for analysis

How to use Lens:

  1. Open Camouflage desktop app
  2. Click "Network Lens" in the tray menu
  3. Toggle monitoring on
  4. View all your network connections in real-time

📊 Lens Data Table​

The new Lens view includes a full-featured data table:

  • Sortable columns (Time, App, Destination, Port, Protocol, Bytes)
  • Pagination for large datasets
  • Filter by application name
  • Filter by time range
  • Full-text search across all fields
  • Sticky table header while scrolling

📈 Summary Statistics​

At a glance, see:

  • Total connections observed
  • Unique services/destinations reached
  • Total bytes transferred
  • Percentage of connections with resolved app names

What's new in version 0.2.1

Release Highlights​

Version 0.2.1 focuses on improving the desktop app experience with automatic daemon version management and better lifecycle controls.

New Features​

🔄 Automatic Daemon Version Detection & Updates​

The desktop app now automatically detects when the system daemon version doesn't match the app version:

  • Version Checking: On startup, checks if daemon matches app version
  • Auto-Detection: Detects old daemons that don't support version reporting
  • Seamless Updates: One-click "Reinstall Daemon" updates the system service
  • User-Friendly: Shows clean "Update Required" screen instead of errors

What happens when you update the app:

  1. App detects old daemon → Shows "Update Required" screen
  2. Click "Reinstall Daemon" → Prompts for password once
  3. Daemon updated automatically → Ready to use!

🗑️ Uninstall Feature​

Added proper uninstall support following macOS/Windows best practices:

  • Tray Menu: "Uninstall Daemon..." option in system tray
  • Confirmation Dialog: Clear explanation of what will be removed
  • Complete Cleanup: Removes all system services and files
  • Guided Process: Instructions to manually delete the app bundle

What gets removed:

  • macOS: LaunchDaemon, binary, logs, socket files
  • Windows: Windows Service and related files
  • App bundle/folder must be deleted manually (standard OS behavior)

🏷️ CLI Version Support​

All command-line binaries now support --version:

camouflage-client --version    # Output: 0.2.1
camouflage-daemon --version    # Output: 0.2.1
camouflage-relay --version     # Output: 0.2.1
camouflage-cli --version       # Output: 0.2.1

Detailed version checking:

camouflage-client version
# Output:
# Client version: 0.2.1
# Daemon version: 0.2.1
# ✓ Versions match

Improvements​

  • Better Error Messages: Clearer feedback when daemon version mismatches
  • Logging: Version info logged for easier debugging
  • Documentation: Updated README with uninstall instructions

Bug Fixes​

  • Fixed issue where old daemons would cause silent failures
  • Improved daemon status detection reliability
  • Fixed version display in update prompts

What's new in version 0.2.0

Release Highlights​

Version 0.2.0 introduces Camouflage Community Edition - a complete, free-forever VPN solution with support for up to 10 nodes across 2 networks. This release also includes a major documentation restructure and architectural improvements.

Community Edition Launch​

All-in-One Docker Container​

Community Edition packages everything you need into a single Docker container:

  • Web UI - Full-featured control plane (port 9443)
  • Dual VPN Daemons - Support for 2 isolated networks
  • Built-in Database - SQLite for zero-config deployment
  • Automatic Setup - SSL certs, admin user, and default networks created on first boot
# Get started in 3 commands
docker pull camouflagenetworks/camouflage-ce:0.2.0
docker volume create camouflage_data
docker run -d -p 9443:9443 -p 61700:61700/udp -p 61701:61701/udp \
  --cap-add=NET_ADMIN --cap-add=NET_RAW \
  -v camouflage_data:/data camouflagenetworks/camouflage-ce:0.2.0

Edition Comparison​

Community Edition (Free Forever):

  • 10 nodes total across all networks
  • 2 networks maximum
  • Integrated VPN daemons
  • Perfect for small teams, home labs, personal use

Cloud Edition (Unlimited):

  • Unlimited nodes and networks
  • Dedicated relay servers
  • High availability gateways
  • Multi-site deployments
  • Business support & SLA

New Features​

🚀 2-Network Architecture for CE​

Community Edition now supports 2 independent networks out of the box:

  • Network 1 - Primary Network (10.99.0.0/24) on port 61700
  • Network 2 - Secondary Network (10.98.0.0/24) on port 61701
  • Separate daemon processes for network isolation
  • Auto-configured on first boot

Use Cases:

  • Separate dev/prod environments
  • Different teams or projects
  • Isolated network segments
  • Testing configurations

📚 Documentation Restructure​

Complete documentation overhaul for clarity:

  • Community Edition Section - CE-specific installation and setup
  • Enterprise Edition Section - Relay servers, gateways, Kubernetes
  • Architecture Diagrams - Mermaid diagrams showing CE vs BE architectures
  • Clear Upgrade Path - Migration guide from CE to BE

🎨 Enhanced Architecture Diagrams​

Added comprehensive mermaid diagrams:

  • System architecture overview (CE vs BE)
  • Network flow diagrams
  • Deployment models
  • Security architecture
  • Multi-relay HA setups

⚡ Simplified Installation​

Before (0.1.9):

  • Multiple components to configure
  • Manual SSL certificate setup
  • Complex networking configuration

After (0.2.0):

  • Single Docker container
  • Auto-generated SSL certificates
  • Zero-config default setup
  • Works in 3 commands

Technical Improvements​

Daemon Management​

  • CE Daemon Manager - New service for managing dual daemons via supervisord
  • Auto-configuration - Daemon configs generated from Network model
  • Lifecycle Management - Start/stop/restart via supervisorctl API
  • Slot Allocation - Automatic assignment of daemon slots to networks

Bootstrap Enhancements​

  • Creates 2 default networks on first boot
  • Generates network-specific TOML configs
  • Assigns daemon ports (61700, 61701)
  • Configures supervisord processes
  • ACL disabled by default (permissive mode)

Requirements Updates​

Updated system requirements to reflect lightweight CE architecture:

Community Edition:

  • 1 CPU core minimum
  • 512 MB RAM (daemon uses ~50MB per 10 nodes)
  • 5 GB disk space
  • Docker 20.10+

Breaking Changes​

Port Configuration​

Community Edition now requires 2 UDP ports:

  • Port 61700/udp - Network 1 daemon
  • Port 61701/udp - Network 2 daemon

Migration: Update firewall rules and Docker port mappings to include both ports.

Documentation URLs​

Documentation structure has changed:

  • /installation/community-edition/ - CE installation
  • /installation/enterprise-edition/relay-server/ - BE relay setup
  • /installation/enterprise-edition/gateway/ - BE gateway setup

Migration: Update any bookmarks or links to documentation.

Bug Fixes​

  • Fixed relay connection stability issues
  • Improved daemon container lifecycle management
  • Enhanced network configuration validation
  • Corrected node limits enforcement (10 nodes across all networks)
  • Fixed ACL enforcement in permissive mode

Upgrade Instructions​

Upgrading from 0.1.9 to 0.2.0​

If you're running the previous version, follow these steps:

  1. Backup your data:

    docker exec camouflage-ce tar czf /data/backup.tar.gz /data/db.sqlite3
    docker cp camouflage-ce:/data/backup.tar.gz ./backup.tar.gz

  2. Stop and remove old container:

    docker stop camouflage-ce
    docker rm camouflage-ce

  3. Pull new version:

    docker pull camouflagenetworks/camouflage-ce:0.2.0

  4. Run with updated ports:

    docker run -d \
      -p 9443:9443 \
      -p 61700:61700/udp \
      -p 61701:61701/udp \
      --name camouflage-ce \
      --cap-add=NET_ADMIN \
      --cap-add=NET_RAW \
      -v camouflage_data:/data \
      camouflagenetworks/camouflage-ce:0.2.0

  5. Update firewall:

    sudo ufw allow 61701/udp

Your existing networks and nodes will be preserved.

Coming Soon​

  • Mobile support - iOS and Android apps
  • Terraform provider - Infrastructure as code
  • Prometheus metrics - Enhanced monitoring
  • IPv6 support - Dual-stack networking

For detailed installation instructions and upgrade guides, see the Installation section.