About
Sanctum is a small, reviewable, capable, PQ-secure and fully privilege separated VPN daemon for OpenBSD, Linux and MacOS. It is designed from the ground up with security in mind and will always be open and free, licensed under the ISC license.
Sanctum uses strong cryptography and a unique hybridized key exchange that combines symmetrical keying with classical and PQ-secure asymmetry. See docs/crypto.md for a detailed description of the cryptosystem in sanctum.
It allows the creation of different topologies from traditional site-to-site or client-to-site tunnels, to one-way tunnels or p2p e2ee secure links between devices, even when behind NAT.
Sanctum is often used to create more secure replacements for things like Tailscale or Zerotier.
A community driven sanctum cathedral network can be found at The Reliquary.
Building
See docs/building.md for building instructions.
Hacking
Please send your git patches to priests@sanctorum.se.
Configuring
See share/example.conf for a simple example configuration.
For more hands on examples, see the different guides below:
Talks
Library
You can use libkyrka to implement the sanctum protocol and p2p e2ee tunnels into your application directly.