Kiwi Network

Open source · self-hosted · no accounts

Your own private network, built from one file.

Kiwi Network is a set of open-source tools. kiwi-server turns a VPS and the machines you own into a WireGuard mesh with its own DNS, its own certificate authority and your services behind it. kiwi-updater puts privacy apps on your Fedora Atomic desktop and keeps them current, straight from git.

Build a network Set up a desktop
fleet.yamlone file, every machine
hosts:
  gate:                       # a VPS
    role: master
    target: debian
    master:
      vpn-client: { vpn_provider: mullvad, … }
      vpn-server: { wg_host: vpn.example.org }
  sh3:                        # a box at home
    role: node-cloud
    target: ucore
    node-cloud:
      vpn-client: { wireguard_config: secrets/sh3.home.conf }
$ kiwi-server build fleet.yaml → a first-boot script and an unattended install ISO per host

The network

One door in. Everything else behind it.

A Kiwi Network is a WireGuard mesh with one hub, the kiwi-master. It is the only machine that has to be reachable from the Internet. Nodes, laptops, phones and routers dial out to it and meet in the mesh.

Internet
the mesh's traffic leaves through a commercial VPN
(gluetun · Mullvad by default): the double hop
kiwi-master role master · a VPS or any reachable box
  • wg-easy WireGuard server · 10.8.0.1
  • gluetun the master's own exit
  • Pi-hole DNS for the mesh
  • Tor SOCKS5 for mesh clients
UDP 51820: the one port the stack publishes
WireGuard mesh · 10.8.0.0/16 · every device dials out to the master
kiwi-node · cloud Nextcloud AIO, Vaultwarden, behind nginx with the fleet's certificate
kiwi-node · gateway routes its LAN through the VPN; Pi-hole, DHCP relay, a download station that has no route if the tunnel drops, SFTP
Laptops & phones WireGuard clients of wg-easy, optionally in an isolated subnet that sees services but not each other
Routers OpenWrt (a generated script), FritzBox and others bring a whole LAN into the mesh

One resolver chain

Every Pi-hole asks the master's first, so the whole network shares one blocklist and every lookup leaves through the master's exit. Quad9 only answers while the master is unreachable.

DNS & names →

Names that can't leak

Services are cloud.sh3.home, vault.sh3.home. .home is never delegated as a public TLD, so nobody else can register your names or get a certificate for them.

Why .home →

Your own CA

One certificate authority for the fleet, which can be name-constrained to your domain. Every machine kiwi-server builds trusts it; import kiwiCA.pem on your devices and internal HTTPS just works.

The fleet CA →

Reboots in your window

Updates install continuously: Zincati on CoreOS, staged rpm-ostree on uCore, unattended-upgrades on Debian. A machine only reboots inside the window you choose.

Updates →

kiwi-server

Describe it. Boot it. Walk away.

kiwi-server renders each host's role into one bash script, an Ignition or preseed config and an unattended install ISO. All templating happens on your machine; the host only needs docker. A CLI and a GTK4 app, installed in ~/.local.

  1. 1

    Write the fleet

    kiwi-server init
$EDITOR fleet.yaml
kiwi-server validate fleet.yaml
  2. 2

    Build the media

    kiwi-server build fleet.yaml
sudo dd if=output/sh3/sh3.iso \
  of=/dev/sdX bs=4M oflag=sync
  3. 3

    Boot

    The ISO installs to the disk you named without asking, reboots, and runs the role once. The stack comes up; kiwi-stack runs it from then on.

master

The WireGuard entry point with the double hop, Pi-hole and Tor.

  • vpn-client
  • vpn-server
  • dns
  • tor

node-gw

A LAN gateway through the VPN, with DNS, DHCP relay and a download station.

  • vpn-client
  • dns
  • dhcp-relay
  • reverse-proxy
  • downloader
  • gateway
  • portainer
  • sftp

node-cloud

Your cloud and your passwords, on the LAN and in the mesh.

  • vpn-client
  • reverse-proxy
  • cloud
  • vault
  • portainer

bare

Admin user, SSH keys, automatic updates. A clean base to build on.

  • no modules

Targets Fedora CoreOSuCoreDebian stable kiwi-server quick start →

The desktop

Apps from git, on an image-based desktop.

Built for Fedora Silverblue and Bluefin. kiwi-updater installs apps from git catalogs: an app is a repo with a kiwi.manifest and an install.sh, a release is a git tag. Everything goes in your home; an app that needs root says why before it asks. The immutable /usr is never touched.

curl -fsSL https://raw.githubusercontent.com/derlocke-ng/kiwi-updater/main/get-kiwi.sh | bash -s -- --with-system
kiwi catalog add https://github.com/derlocke-ng/kiwi-catalog.git
v0.2.2 user + root

kiwi-killswitch

A fail-closed VPN kill switch for GNOME. A root nftables daemon, driven from Quick Settings, a GTK4 app or the CLI, never asking for a password. If the tunnel drops, nothing leaves.

 v0.1.3 rootless Podman

kiwi-fox

Isolated Windows 11 browser identities, each with its own storage, exit, ad-blocking DNS and frozen fingerprint. The kill switch is the absence of a route.

 tracks main 4 modules

kiwi-fox providers

Exits for kiwi-fox: Tor (a circuit per profile), a VPN through gluetun, 9proxy residential, the Mysterium dVPN. Each one speaks SOCKS5 and nothing else.

 v2.1.1 Bluefin-DX

ensconce

Turns a fresh Bluefin into your workstation from plain list files: packages, Flatpaks, extensions, Nextcloud sync, dconf, the login screen. --export clones a machine.

 v1.0.0 CLI

kiwi-cli-tools-desktop

pweb serves a folder over HTTPS, select-server picks a host from your SSH config, tethering fixes the TTL for hotspot traffic.

 v2.0.0 CLI + GTK4

kiwi-updater

Itself an app in the catalog. One user timer updates everything every six hours, root halves through a fixed-purpose polkit helper. kiwi diff before, kiwi pin to hold.

Also: kiwi-gen, SSH and TLS keys and certificates made offline in your browser, in an encrypted vault (try it).

Status

Where each piece stands.

Young projects, described as they are. "Released" means a version tag, which is what kiwi-updater installs.

RepositoryStateNotes
kiwi-servermain · 2.2.0Generators tested in CI; first boot on real hardware not yet verified from the new pipeline. Not in the catalog: kiwi add it.
kiwi-updaterv2.0.0Catalog registry and tag signatures planned.
kiwi-killswitchv0.2.2Not independently audited.
ensconcev2.1.1
kiwi-foxv0.1.3The provider subsystem is on main, after v0.1.3.
kiwi-plugin-tor · vpn · 9proxy · mystmain · 0.1.0Unit-tested; VPN, 9proxy and Mysterium need a real account to validate end to end.
kiwi-cli-tools-desktopv1.0.0
kiwi-genweb pageMIT. Runs from disk or GitHub Pages.
kiwi-pentestingscaffoldCore library and catalog only; no CLI, GUI or installer yet.
kiwi-cloud, kiwi-vpn-monitorsupersededBy kiwi-server's node-cloud and by kiwi-killswitch.

All repositories and known gaps →