Brings the in-app tutorial in line with the current behavior.

• Local Network is now described as an independent, always-in-effect layer (it was still worded as only applying "while the killswitch is active", which stopped being true after the 1.0.2/1.0.4 firewall refactor).
• Updates: documents the in-app update path — when an update is found, an "Update X.Y.Z" item appears at the top of the sidebar to install it — plus the manual check in Settings, alongside the existing daily auto-check and lazyvpn update CLI.
• Adds Theming (LazyVPN matches your Omarchy theme automatically) and Uninstall (lazyvpn uninstall) tips.

Tutorial copy only — no functional change.

Clears up the firewall model — three independent layers, each toggled by a single full rebuild of the UFW ruleset — and fixes a broken README Quick Start.

Firewall

• Killswitch is outbound-only: forces traffic through the tunnel (deny outgoing + reject on the physical interface) and never touches the incoming policy. Inbound is owned entirely by the Local Network layer.
• Local Network owns the inbound posture:
  • Allow — LAN reachable inbound + outbound.
  • Stealth — outbound LAN works; all unsolicited inbound is blocked (LAN and internet), replies still flow.
  • Block — total LAN isolation: only the gateway is locally reachable (so you can still route out), no LAN in or out, no inbound at all.
• Every UFW toggle now does a full teardown-and-rebuild of the entire lazyvpn ruleset in one validated, deterministic order — so rule ordering and layer independence are correct by construction.
• IPv6 protection is a self-standing UFW layer alongside the other two.

Docs

• Fix the README Quick Start: it told users to run ./lazyvpn install but shipped no binary and no build step. It now leads with the release-binary download, with build-from-source as a fallback. (#10)

Documentation release. No functional changes from 1.0.2.

• README refreshed to match the 1.0.2 model: the killswitch (forces all traffic through the tunnel) and Local Network (Allow / Stealth / Block) are documented as independent layers; Stealth is the install-time default; the tagged-rules list now includes lazyvpn:la; install step 4 notes establishing the default Local Network mode.

Local Network and killswitch are now fully independent layers

• Local Network mode is a standing constant, in effect whether or not the killswitch is engaged. All three modes lay down explicit, inspectable UFW rules per private range:
  • Allow — allow inbound + outbound (genuine full LAN access, even on a deny-incoming base like Omarchy's default)
  • Stealth — allow outbound, deny inbound (coffee-shop mode)
  • Block — deny inbound + outbound
• Stealth is now the default, established as a visible, consented step during install.
• The killswitch no longer touches LAN traffic — it owns leak prevention only. LAN egress survives by UFW first-match ordering; changing LAN mode while the killswitch is on re-applies it so its reject stays last.

State-aware update action

• The Settings update control is now 2-state: "Check for Updates Now" until a check finds a newer release, then "Install update X.X.X". The nav-banner dialog button reads "Install" to match.

Fixes the manual Check for Updates Now action — the result now displays instead of getting stuck on "Checking…". See CHANGELOG.

First stable release of LazyVPN — a single Go binary with a Bubbletea TUI for managing WireGuard VPN connections on Linux (Omarchy primary target).

Highlights

• WireGuard via direct netlink + wgctrl (no wg-quick / systemd-networkd)
• UFW-based killswitch that forces all traffic through the tunnel, with three Local Network modes: Allow (LAN in+out), Stealth (outbound only — coffee-shop mode), Block (no LAN); gateway always reachable
• IPv6 leak protection
• Dynamic server browser — lists mirrored weekly into the server-data branch (resilient to upstream changes)
• Health-monitoring daemon with auto-recover + auto-failover
• Built-in leak test, speed test, security audit
• Opt-in update checking: daily auto-check and an on-demand "Check for Updates" action
• Waybar / Hyprland / app-launcher integration
• Interactive install, 16-step uninstall

Install

git clone https://github.com/blank-query/lazyVPN-for-Omarchy.git
cd lazyVPN-for-Omarchy
./lazyvpn install

ProtonVPN is verified; Mullvad, IVPN, AirVPN, NordVPN, Surfshark, Windscribe, FastestVPN are wired but unverified. See CHANGELOG.md.

A recent Omarchy update assigned a default keybind to SUPER + L causing a conflict with LazyVPN.

Keybind was changed to SUPER + SHIFT + L to avoid this conflict.

Added uninstall and installation repair paths to the installer. If you get stuck in a half-installed state now you can just run the installer again.