Skip to content

API

Version 2.0.0

  • Released July 20, 2026

Added

  • Option to use PKCS #11 token for DB ALEK (Application Level Encryption Key).
  • Option to use Azure Key Vault for DB ALEK.
  • New KEY_GEN_SOURCE env var to configure RNG (Random Number Generator) used for new key material.
  • CLI commands to test ALEK and RNG settings, and to rotate ALEK.
  • Controller action to delete device-sync settings.
  • Log request method, URL, and headers on errors to SKA-P (or other external) REST APIs.

Changed

  • Rebranded from Crux VPN to just Crux, renaming all files, directories, and services that previously had cruxvpn in their names to crux; plus some additional name changes detailed below. The Linux upgrade script will automatically make all necessary name changes when upgrading from 1.x to 2.x. Docker upgrades need to follow steps in the Upgrade to 2.0 documentation.
  • All agent requests now use /api/g/ prefix (allowing for agent-specific access control settings in Nginx config).
  • Renamed Ubuntu install script to just install-on-ubuntu.sh; can be used to install on any version of Ubuntu since 24.04.
  • Default to using host FQDN as canonical hostname for new installs.
  • Default TLS cert to none for new installs (instead of defaulting to generating a cert with Let's Encrypt).
  • Default to using no email address with Let's Encrypt.
  • Option to copy TLS cert from specified location during new installs.
  • Automatically set OUTBOUND_HTTP_SSL_CA_CERT env var to system trust store for new Ubuntu installs.
  • Apply custom canonical port to Nginx config for new Ubuntu installs.
  • Pin DB image to PostgreSQL 18 for new Docker installs.
  • Separated out Crux EULA and third-party notices from packaged LICENSE file (into Crux_EULA.txt and NOTICE files).
  • Upgraded from Erlang/OTP 28.4.2 to 29.0.3.
  • Upgraded from Elixir 1.19.5 to 1.20.2.

Fixed

  • Fixed syslog ident value to stay api (sometimes would change to null or garbage values).
  • Added missing license notices for Erlang/OTP & Elixir runtimes, and for pageantry library.

Renaming Crux VPN to Just Crux

Following are the principal name changes on each platform; see the Upgrade to 2.0 documentation for full details:

  • Docker, new installs and upgrades:
    • Image name changed from ghcr.io/siriuscomputer/cruxvpn-api to ghcr.io/siriuscomputer/crux-api
    • API config directory mapping changed from /etc/cruxvpn to /etc/crux
    • DB image tag changed from docker.io/postgres:alpine to docker.io/postgres:18-alpine
    • DB volume name changed from db to db_18
  • Docker, new installs only:
    • DB name changed from cruxvpn_db to crux_db
    • DB username changed from cruxvpn_user to crux_user
  • Linux, new installs and upgrades:
    • API service name changed from cruxvpn-api to crux-api
    • API service user & group names changed from cruxvpn to crux
    • Env vars file name changed from /etc/default/cruxvpn-api to /etc/default/crux-api
    • API license directory changed from /etc/cruxvpn/license to /etc/crux/license
  • Linux, new installs only:
    • Root directory changed from /srv/cruxvpn/ to /srv/crux/
    • DB name changed from cruxvpn_db to crux_db
    • DB username changed from cruxvpn_user to crux_user

Version 1.18.0

  • Released April 19, 2026

Added

  • Added Use TLS option to agent SKA config settings.
  • Added Sigstore signatures to artifact downloads.
  • Controller actions to upload and refresh license files.

Changed

  • Upgraded from Erlang/OTP 28.3.3 to 28.4.2.

Fixed

  • Avoid logging errors for device sync when client secret not set.
  • Query for duplicates when generating new SKA device IDs, and add number to ID if necessary to make it unique (eg if Test-Host-abc123 is already registered, use Test-Host-1-abc123 instead).
  • Clear all unfinished recurring tasks at startup (which should eliminate the source of most "recurring task hung" errors).
  • Fixed "extras invalid: Does not allow rotate before/after" errors.

Version 1.17.0

  • Released March 4, 2026

Added

  • Database tables and application logic to store and show connectivity issues reported by agents.
  • Database tables and application logic to store and show inventory properties reported by agents.
  • Ability to automatically factory-reset device upon receiving "terminal authentication failure" connectivity issue.
  • Apply SKA DUID received from agent.
  • Support for new SKA-P deregister API call (requires SKA-P release v25.12 or newer).
  • Added option to deregister a device from the SKA-P when deleting a host.
  • Added API_IP env var to allow API listen address to be set (default is to listen on all addresses). Install script automatically sets API_IP=0.0.0.0 on systems missing IPv6 support.
  • Database column and application logic to use dedicated private TLS CA certs for SKA-P API calls (if not configured, defaults to CA certs from OUTBOUND_HTTP_SSL_CA_CERT env var; otherwise falls back to CA certs from Certifi bundle).

Changed

  • Cache CA certificates configured by OUTBOUND_HTTP_SSL_CA_CERT env var instead of parsing them fresh for each request.
  • Allow CheckWgPeerPingTimeout & InventoryInterfaceFilter agent config settings.
  • Upgraded from Erlang/OTP 28.3.1 to 28.3.3.

Version 1.16.1

  • Released February 18, 2026

Added

  • Allow custom CA certs for outbound HTTPS requests (such as to the SKA-P APIs) via new OUTBOUND_HTTP_SSL_CA_CERT env var; eg: 
    OUTBOUND_HTTP_SSL_CA_CERT=/etc/ssl/certs/ca-certificates.crt

Version 1.16.0

  • Released January 17, 2026

Added

  • Controller actions and database tables to configure agent via web UI, and provide configuration to agent.
  • Controller actions and database tables to configure registration credentials and settings via web UI, and provide credentials/settings to agent.
  • Controller actions to provide combined agent & setup config to web UI.

Changed

  • Provide config last-updated timestamp to agent on ping requests, and accept and store config last-applied timestamp from agent.
  • Automatically lock/unlock agent when device is quarantined/unquarantined.
  • Upgraded from Erlang/OTP 28.2 to 28.3.1.
  • Upgraded from Elixir 1.19.4 to 1.19.5.

Removed

  • Removed some redundant /super/ska/devices URL paths.

Version 1.15.0

  • Release December 7, 2025

Added

  • Unregistered display calculation.
  • Rotate-now actions.

Changed

  • Updated defaults for SKA-P to use new SKA version 25.9 URLs and PaaS region.
  • Migrated SKA-related database table names to use "ska" prefix in place of "pqc".
  • Renamed SKA-related modules, logging, and URLs to use "ska" identifier in place of "pqc".
  • Upgraded from Erlang/OTP 28.1.1 to 28.2.
  • Upgraded from Elixir 1.19.2 to 1.19.4.

Fixed

  • Fixed restore-to-point action to fully recalculate SKA-related endpoint settings.

Version 1.14.0

  • Released November 13, 2025

Added

  • Controller action and integration with SKA-P to quarantine a device.
  • Controller action and integration with SKA-P to add and remove a device to and from security groups.
  • Controller action and integration with SKA-P to query for current list of security groups.
  • Controller action for deleting a host can now optionally also delete all of the connections to the host from other hosts.
  • Controller actions to cancel all pending changes or mark all pending changes as applied manually.
  • Controller action to restore a deleted user.

Changed

  • Deleted users are now filtered out of host members list; setting up a new agent for a host will no longer attempt to use a deleted user.
  • Peer identities that have been deleted through the web UI are no longer automatically restored when used by an agent.
  • Optimized queries for endpoint stats list & chart.
  • Optimized queries for IPs chart on dashboard.
  • Upgraded from Erlang/OTP 28.1 to 28.1.1.
  • Upgraded from Elixir 1.18.4 to 1.19.2.
  • New library for logging to syslog (syslogger instead of ex_syslogger).
  • Ubuntu install script now turns on option for better syslog integration by default.

Fixed

  • Fixed restore-to-point functionality to not attempt to restore old preshared keys or SKA-P device details.

Version 1.13.0

  • Released October 24, 2025

Changed

  • Changed canonical OCI image name from ghcr.io/crux-comms/cruxvpn-api to ghcr.io/siriuscomputer/cruxvpn-api.
  • Disabled cosign build signing temporarily (until other infrastructure pieces are moved into place).
  • Upgraded from Erlang/OTP 27.3.4.1 to 28.1

Version 1.12.0

  • Released September 29, 2025

Added

  • SKA-P per-tenant/organization device sync.
  • DB tables for saving tenant and device information.
  • Controller actions supporting SKA-P integration in web UI.
  • Change events pushed to agents from device sync.
  • Helper scripts for upgrading native install (in api/ops/upgrade directory of tarball).
  • Mkcert option (to generate test SSL cert) in install scripts.
  • Included full web UI webops directory in Docker image.
  • Enable downloads of full Agent, Android APK, API, and Web UI directories.

Changed

  • Replaced separate cruxvpn-api-generate-docker-compose and cruxvpn-api-update-geoip-data Docker images with the ability to run the ops/install/generate-docker-compose.sh and ops/geolite2/download-process-deploy.sh scripts directly from the main cruxvpn-api Docker image.

Removed

  • Removed SKA-P single-tenant audit-export polling.

Version 1.11.0

  • Released August 17, 2025

Added

  • Capture and log manual SKA-P deregister device events.
  • Controller action to help pick hub hosts.

Changed

  • Updated default SKA-P API URLs to match SKA-P 25.06 release.

Version 1.10.0

  • Released July 10, 2025

Added

  • Adds 3 new security-related headers to HTTP responses: 
    Content-Security-Policy: default-src 'none'; form-action 'none'; base-uri 'none'; frame-ancestors 'none'; sandbox
Strict-Transport-Security: max-age=7776000
X-Content-Type-Options: nosniff
    HSTS header is included only if its max age is specified via the HSTS_MAX_AGE env var; eg HSTS_MAX_AGE=90d for 90 days.
  • Optional S3 signed URLs for agent downloads. Enabled via DOWNLOADS_ACCESS_KEY_ID (and other DOWNLOADS_*) env vars.
  • Optional EULA acceptance tracking. Enabled via TERMS_LAST_UPDATED env var (eg TERMS_LAST_UPDATED=2025-07-01).
  • Mandatory seat-based license-key enforcement. License keys must be placed in directory specified by LICENSE_DIR env var (defaults to /etc/cruxvpn/license).

Changed

  • Upgraded from Erlang/OTP 27.2 to 27.3.4.1
  • Upgraded from Elixir 1.17.3 to 1.18.4

Removed

  • Removed preshared-key mismatch alert (which was incongruent with keys generated via SKA-P).

Version 1.9.2

Added

  • Support for Ubuntu 24.04 installations
  • New functionality to connect to Arqit API
  • New log entries based on changes pushed via Arqit API

Changed

  • Changes to registration flow based on Arqit device properties
  • Rearrange PSK logic in endpoint controller

Version 1.8.0

  • Initial Release