CumulusVPN: Windows, In-App Payments, and Surviving a Network Roam

Fluxers! CumulusVPN — the accountless, decentralized VPN that runs as enterprise Flux applications on datacenter nodes — had a busy August. Desktop 1.2.0 brought Windows, in-app payments and voucher redemption; the mobile apps learned to survive moving between networks; and the fleet dashboard stopped inventing outages.

Here is where the project stands and what changed.

The idea, briefly

If you have not come across it: CumulusVPN has no accounts. Your WireGuard public key is your identity. You generate it on your own device, and there is no email address, no name and no card anywhere in the system.

The gateways are Flux application instances running on datacenter nodes across dozens of countries — 135 gateways in 23 countries at the last count. Payments are in FLUX on the native chain, and every gateway independently verifies them by scanning the Flux blockchain. There is no central authority to ask. If our company vanished tomorrow, the deployed gateways would keep working until their specifications expire.

It is free for everyone at 100 KB/s, and $0.99 a month for full speed.

Beyond plain WireGuard, the gateways already carry AmneziaWG traffic obfuscation, WireGuard-over-TLS, multi-hop routing and a stealth transport on port 443, with automatic fallback between transports. That last part is what keeps it working on networks that block ordinary VPNs.

Desktop 1.2.0

The desktop release brings Windows alongside macOS and Linux, plus in-app payments and voucher redemption, so buying full speed no longer means leaving the app.

Two fixes in that release are worth calling out because they are the kind that only turn up in real use:

• Card checkout was dead on the web — a missing CORS header on the payment bridge. Anyone who tried to pay by card in a browser hit a wall for a while. Fixed.
• Store purchases made in the sandbox got nothing. App store review teams buy in a sandbox environment, and our payment path did not recognise those purchases. That is a shipping blocker rather than a bug.

We also made it clear in the apps and the store listings that premium is per device, which is where people buy it and therefore where it needs to say so.

Roaming between networks

This is the one most people will actually feel. You walk out of the house, your phone drops Wi-Fi and picks up cellular, and the tunnel — which was bound to an interface that no longer exists — quietly stops carrying traffic.

Both mobile and desktop now survive a roam between networks. On mobile there is also a backstop for the case where the native rebind cannot repair the tunnel on its own, because the platform APIs do not always tell you what happened.

Alongside that, a data race in multi-hop setup was closed in the tunnel core — the sort of bug that produces an occasional failed connection that nobody can reproduce.

A dashboard that tells the truth

The fleet monitor was reporting gateways as down when they were not. The cause was the sweep: probing the whole fleet at once, cold, from a page that was also trying to serve you a cached answer. Three fixes went in — the stale-while-revalidate actually serves stale now, the cold sweep no longer blocks, and the probe count was tuned against production rather than against a guess.

A monitoring page that cries wolf is worse than no monitoring page, because you stop reading it.

Tested, not assumed

Less visible but more important: the desktop client’s Rust half now builds and tests on every push, the Go tunnel core is covered by the same check, and the full package set is verified rather than a subset. A VPN is a piece of software you route your entire network through. It should be the most boringly well-tested thing you run.

Where it is

The iOS and Android apps are built, signed and submitted, with a macOS build alongside them; public availability now depends on Apple’s and Google’s review queues rather than on us. The desktop builds are available now.

Client and gateway source are open. The deployment — the image, the private registry, which nodes it runs on — is enterprise-encrypted, which is deployment privacy rather than closed source; the build is reproducible, so anyone can verify that the source matches what runs.

Follow along at cumulusvpn.com.