Skip to content
EON Path
Install
Server

Server

Overview

The EON Path server is distributed as two Debian packages:

  • eonpath-api — the management API (PQKS: post-quantum key server). Stores registered client public keys and endpoint configuration, and exposes a REST API and web UI.
  • eonpath-server — the tunnel server daemon. It authenticates clients with the ML-DSA-87 challenge-response protocol and, in a single process, serves both of EON Path’s connection methods: an SSH-based proxy method and a WireGuard-based routing method (the VPN this documentation focuses on). The routing method is enabled by default in the packaged systemd unit.

Both packages install systemd units, create a dedicated eonpath system user, and generate the secrets and host keys the services need on first install.

Prerequisites

  • Debian 11+ or Ubuntu 22.04+, amd64
  • Root or sudo access
  • A firewall that allows inbound UDP on the WireGuard port (see Firewall below)

Only amd64 .deb packages are published; there is currently no arm64 package.

Install the packages

Download the eonpath-api and eonpath-server .deb files for your release, then install the API first so the server’s public-key lookups work immediately:

sudo apt install ./eonpath-api_*.deb       # API + web UI
sudo apt install ./eonpath-server_*.deb    # SSH proxy + WireGuard VPN

Installing with apt install ./<file>.deb (rather than dpkg -i) also resolves the packages’ dependencies (libc6, iproute2) automatically.

On first install, each package’s postinstall script:

  • creates the eonpath system user and group (shared by both packages)
  • creates /etc/eonpath and /var/lib/eonpath
  • generates an ed25519 SSH host key for eonpath-server
  • generates random JWT_SECRET and DB_ENCRYPTION_KEY values for eonpath-api
  • seeds /etc/eonpath/server.conf and /etc/eonpath/server.env from their .example files if they don’t exist yet — an existing file is left alone
  • enables and starts the corresponding systemd service

What gets installed

PathDescription
/usr/bin/eonpath-serverserver binary
/usr/bin/eonpath-apiAPI binary
/lib/systemd/system/eonpath-server.servicesystemd unit
/lib/systemd/system/eonpath-api.servicesystemd unit
/usr/bin/eonpath-licenselicence helper shipped with the API package
/etc/eonpath/server.envserver configuration (environment file), seeded from server.env.example
/etc/eonpath/server.confendpoint registration and endpoint list, seeded from server.conf.example (mode 0640)
/etc/eonpath/api.envAPI configuration, including generated secrets
/usr/share/eonpath/webthe API’s web UI
/usr/share/doc/eonpath-*/ENDPOINT_LIFECYCLE.mdstandby/active states, activation and the evaluation window
/etc/logrotate.d/eonpath-{server,api}rotation for the audit logs
/var/lib/eonpath/state: SSH host key, authorized_keys, PQKS database

Configure the server

Server settings live in /etc/eonpath/server.env, an environment file read by the systemd unit:

# SSH listener (post-quantum SSH proxy method)
EONPATH_SSH_ADDR=0.0.0.0:2022

# Local PQKS API endpoint (used to look up client keys when a client connects)
EONPATH_API_ENDPOINT=http://localhost:8080

# HTTP CONNECT proxy address (for the proxy method's tunnels)
EONPATH_PROXY_ADDR=localhost:2290

# WireGuard VPN settings (for the routing method)
EONPATH_WG_KEX_ADDR=0.0.0.0:9998
EONPATH_WG_LISTEN_PORT=51820

After editing, restart the service to apply the change:

sudo systemctl restart eonpath-server

See Configuration for the full reference of server settings.

Start and enable the service

The postinstall script already enables and starts eonpath-server on a fresh install. If you need to do it manually (for example after changing the unit file):

sudo systemctl daemon-reload
sudo systemctl enable eonpath-server
sudo systemctl start eonpath-server

Verify it’s running 

sudo systemctl status eonpath-server
sudo journalctl -u eonpath-server -f

If the WireGuard routing method is enabled (the default), the server also brings up a wg0 interface:

ip addr show wg0

Firewall

Clients connect over UDP to the WireGuard routing method. Open the WireGuard port in your firewall:

# UFW
sudo ufw allow 51820/udp comment 'EON Path WireGuard'

# iptables
sudo iptables -A INPUT -p udp --dport 51820 -j ACCEPT

The routing method also needs its TCP key-exchange port reachable before a client can bring up a WireGuard tunnel:

sudo ufw allow 9998/tcp comment 'EON Path WireGuard key exchange'

Clients connect to the server using its public address — a DNS name (for example vpn.example.com) or IP address (for example 203.0.113.10).

If you also use the SSH-based proxy method, open its port as well:

sudo ufw allow 2022/tcp comment 'EON Path SSH proxy'

Upgrading and removing 

# Upgrade: install a newer .deb over the current install. Config, host
# keys, and secrets are preserved.
sudo apt install ./eonpath-server_<newer>_amd64.deb

# Remove, keeping state (host key, authorized_keys, api.env)
sudo apt remove eonpath-server eonpath-api

# Purge, wiping /etc/eonpath, /var/lib/eonpath, and the eonpath user
sudo apt purge eonpath-server eonpath-api
Desktop