Client

Config file location

The desktop and mobile clients share the same configuration format, eonpath.conf, a YAML file. The desktop client looks for it at:

Platform	Path
Linux / Windows	`~/.config/eonpath/eonpath.conf`
macOS	`~/eonpath.conf`

The client rewrites this file when you change settings from the UI (adding a server, adding an endpoint, toggling the system proxy), keeping a eonpath.conf.backup of the previous version. Authentication tokens are not stored in this file — they’re kept in the OS keyring (Keychain, Windows Credential Manager, or the Secret Service on Linux), keyed by API server address.

Example

username: alice
key: ~/.config/eonpath/alice-mldsa-key
proxy:
  port: 9999
system_proxy_enabled: true
auto_start_tunnel: false

api_servers:
  - address: https://api.example.com
    endpoints:
      - name: web-server
        port: 8443
        forwardport: 443
        tunnelip: tunnel.example.com
        tunnelport: 2022
        method: proxy

      - name: full-vpn
        tunnelip: vpn.example.com
        tunnelport: 51820
        method: routing
        kex_address: vpn.example.com:9998
        server_identity: "3b1e...c04a"

auth:
  - address: https://api.example.com
    username: alice
    email: alice@example.com

Top-level settings

Key	Type	Default	Description
`username`	string	(none)	Account username used when authenticating to an API server.
`key`	path	(none)	Path to the client’s ML-DSA private key.
`kex`	string	(none)	Optional key-exchange mode override; per-endpoint `kex` (below) takes precedence when set.
`proxy.port`	int	(none)	Local port for the client’s SOCKS/HTTP proxy, used by endpoints with `method: proxy`.
`system_proxy_enabled`	bool	`false`	Whether the client configures the OS-wide HTTP/HTTPS proxy to point at its local proxy port.
`auto_start_tunnel`	bool	`false`	Start the configured tunnel(s) automatically when the client launches.
`api_servers`	list	(empty)	API servers and the endpoints registered under each — see below.
`auth`	list	(empty)	Per-API-server account metadata (username, email, user ID). The actual bearer token is stored in the OS keyring, not in this file.

API servers

Each entry under api_servers groups a set of endpoints under the API server that manages them:

Key	Type	Description
`address`	string	Base URL of the API server, for example `https://api.example.com`.
`endpoints`	list	Endpoints available through this API server — see below.

Endpoints

Each endpoint describes one tunnel — either a single forwarded port (proxy method) or a full VPN connection (routing method):

Key	Type	Default	Description
`name`	string	(required)	Endpoint identifier, as registered on the API server.
`port`	int	`0`	Local port to listen on (proxy method only).
`forwardport`	int	`0`	Remote port to forward to on the tunnel server (proxy method only).
`tunnelip`	string	(required)	Tunnel server hostname or IP address.
`tunnelport`	int	(required)	Tunnel server port — the SSH port (proxy method) or WireGuard UDP port (routing method).
`kex`	string	(none)	Per-endpoint key-exchange mode override.
`method`	string	`proxy`	Connection method: `proxy` (SSH tunnel) or `routing` (WireGuard VPN).
`kex_address`	string	(none)	TCP address of the routing method’s key-exchange listener (for example `vpn.example.com:9998`). Required for `method: routing`.
`server_identity`	string	(none)	Hex-encoded SHA-256 hash of the server’s pinned ML-DSA-87 identity key. See Server identity pinning.
`server_identity_dns`	string	(none)	DNS TXT record name to fetch the expected identity hash from, as an alternative to `server_identity`.
`companion_hosts`	list of strings	(empty)	Additional hostnames whose resolved IPv4 addresses are routed through the tunnel alongside the endpoint’s main host (routing method).

Identity pinning (server_identity or server_identity_dns) is mandatory for the routing method: the client will not bring up a VPN tunnel to a server whose identity it cannot verify against one of these two sources.

Server