GANVAS VPN for Linux (CLI)

The ganvas command-line client is a single static binary with no daemons. It supports WireGuard, VLESS+WS+TLS (beats blocks) and Tor. Packages are built for amd64 and arm64. Current version — 0.2.2.

Install

Debian / Ubuntu (.deb)

curl -LO https://github.com/gretapablik-debug/ganvas-vpn-releases/releases/download/cli-v0.2.2/ganvas-vpn_0.2.2_amd64.deb
sudo apt install ./ganvas-vpn_0.2.2_amd64.deb

Fedora / RHEL / openSUSE (.rpm)

sudo dnf install https://github.com/gretapablik-debug/ganvas-vpn-releases/releases/download/cli-v0.2.2/ganvas-vpn-0.2.2-1.x86_64.rpm

Arch Linux (AUR)

yay -S ganvas-vpn-bin

Any distro (static binary)

curl -Lo ganvas https://github.com/gretapablik-debug/ganvas-vpn-releases/releases/download/cli-v0.2.2/ganvas-linux-amd64
chmod +x ganvas && sudo mv ganvas /usr/bin/ganvas
sudo apt install wireguard-tools   # or dnf install wireguard-tools

On ARM, use the arm64 / aarch64 packages or binary.

Sign in

sudo ganvas register          # create an account — prints your CODE (save it!)
sudo ganvas login XXXXXXXXXX  # or sign in with an existing code

Connect commands need sudo (network interface access). Sign in with sudo too, so the token is found on autostart.

Connect

sudo ganvas connect              # WireGuard, nearest server (default)
sudo ganvas connect de           # a specific country/server
sudo ganvas connect nl2 --vless  # VLESS+WS+TLS — where WireGuard is throttled
sudo ganvas tor                  # everything through Tor (slow, max anonymity; amd64 only)
sudo ganvas disconnect           # disconnect

Server list: ganvas servers. Current IP: ganvas ip. Status: ganvas status (works without sudo too).

On the first --vless / tor run, the client fetches the needed components (sing-box / Tor) once, automatically. Their integrity is checked against a pinned SHA-256 — a tampered binary won't run.

Leak protection

For VLESS and Tor, strict routing (strict_route) is on by default: all traffic is forced through the tunnel, so route races or misconfiguration can't leak your real IP while you're connected. An active SSH session stays reachable, so a remote login isn't dropped. Turn it off with the environment variable GANVAS_NO_KILLSWITCH=1.

All commands

Command	What it does
`login [CODE]`	sign in with your account code
`register`	create a new account (prints the code)
`servers`	list servers and pings
`connect [ID] [--vless]`	connect (WireGuard or VLESS)
`tor`	connect through Tor (amd64)
`disconnect`	disconnect (any protocol)
`status`	connection status
`ip`	current public IP and country
`logout`	forget the saved login
`version`	client version

Auto-connect on boot (systemd)

The package ships a ganvas-vpn.service unit. Sign in once, set the server/protocol in /etc/ganvas/ganvas.env, and enable autostart:

# /etc/ganvas/ganvas.env
GANVAS_SERVER=de          # empty = nearest
GANVAS_PROTOCOL=wireguard # wireguard | vless | tor

sudo ganvas login XXXXXXXXXX
sudo systemctl enable --now ganvas-vpn

How it works

WireGuard comes up via wg-quick (needs wireguard-tools — installed as a dependency).
VLESS and Tor run through a bundled sing-box (TUN, all system traffic). Tor is self-contained — the official Tor bundle is downloaded.
DNS is sent through the tunnel, IPv6 doesn't leak, and over SSH your session isn't cut (the SSH client's address stays outside the tunnel).

The binary is a single file, with no telemetry. To update, reinstall the newer package.