ztunnel is in active development. This page describes the repository as it stands: the two-layer app/engine split, the build layout and the front-end surface. The roadmap column lists work not yet implemented — it is a plan, not a claim of coverage. Nothing here claims a working capability that is not yet in the codebase.
Two-layer split
| layer | repository | responsibility |
|---|
| desktop app | ztunnel (this repo) | Tauri v2 shell, cyberpunk HUD front-end, action-to-engine wiring, embedded terminal |
| VPN engine | ztunnel-core | config parsing, connection manager, OpenVPN/WireGuard backends, logs, stats — decoupled from any GUI |
Build layout
| path | role |
|---|
| app/src-tauri | thin Tauri host: registers ztn_invoke + terminal commands; setup mounts the engine |
| crates/ztunnel-core | the embeddable VPN engine (submodule, tauri feature) |
| crates/zpwr-embed-terminal | shared embedded PTY terminal (submodule) |
| crates/zpwr-i18n | shared i18n runtime (submodule) |
| frontend | app shell; webui/terminal/i18n assets synced from the submodules before each dev/build |
| scripts | clean · bust · rebuild · nuke (cyberpunk-styled, ported from Audio-Haxor) |
Front-end surface
The HUD (mounted from ztunnel-core/webui) renders a configuration list with live status dots, a connect/disconnect action, a status/throughput grid, per-connection options (route-all, tunnel DNS, auto-reconnect, connect-at-launch), a live log viewer, an import modal (paste .ovpn / WireGuard .conf), a command palette, and the shared embedded terminal. It drives the engine entirely through invoke('ztn_invoke', { cmd, args }) and listens for ztn-event; all wiring is CSP-safe (no inline handlers).
Roadmap
| area | status |
|---|
| App shell + HUD + engine wiring | implemented |
| Config import/parse (OpenVPN/.tblk/WireGuard) | implemented in engine |
| Connection manager + logs + throughput | implemented in engine |
| Privileged helper (utun/tun, routing, DNS) | planned — macOS SMAppService / Linux polkit |
| OpenVPN process supervision + WireGuard data path | planned |
| On-demand connect, network monitoring, full preferences | planned |