GRAND LAUNCHING · 75% off monthly · 85% off annual · locked in forever for current subscribers · ends in — · claim →
Pricing Wiki Blog Download
USD IDR

Changelog

What shipped, when. CLI agent updates roll out via wayangi update; Android updates via in-app "Check for update".

2026-05-28 · Public IPv6 discoverability fix + Windows service + Enterprise tier

28 May 2026

  • Public IPv6 /128 reply-path fix. Inbound from arbitrary external hosts now reaches your device end-to-end, even on ISPs without native IPv6. Source-scoped reply routing (-ifscope on macOS, ip rule on Linux, high-metric route on Windows) sends reply traffic back through wayangi without capturing your normal outbound browsing. Run wayangi update && wayangi stop && wayangi start to pick up the fix.
  • Windows service installer. wayangi service install --token=<TOKEN> registers wayangi as a SCM service running under LocalSystem — fixes wintun's "Failed to create private namespace" error that blocked the interactive PowerShell-as-Administrator path. Auto-starts on every boot; manage via wayangi service status/stop/start/uninstall.
  • Enterprise device tier (super-admin gated). Consumer + enterprise are an orthogonal axis on top of the existing prefix-length tiers. Enterprise devices get IPv6 from a separate routed /56 with outbound + inbound permitted; consumer stays inbound-only with mesh reachability between fellow customers.
  • Dashboard "update agent" badge. Every device row now shows a red ⚠ chip when its binary is older than the latest on the download endpoint. Device detail page renders "Latest available: <version>" next to the agent's own version + a banner with the exact update command. Auto-clears as you update.
  • wayangi -v shows the actual build identifier (was always "(devel — built with go build)"). Format is <short-sha>+YYYY-MM-DD-HH-MM, matching the APK versionName so logs across CLI + Android look consistent.
  • Intra-mesh customer↔customer reachability over the tunnel now works — the routes-split bootstrap installs the customer /56 as an OS route in addition to the link-layer scope, so you can curl another wayangi user's /128 directly through the tunnel even when your local network has no IPv6 transit.
  • Android APK: manifest-signature wire-format mismatch fixed (the verifier was passing raw HTTP bytes to Tink's Ed25519Verify instead of the base64-decoded signature). Self-update now succeeds; previous failure surfaced as "manifest signature did NOT verify — refusing update (possible hub compromise)".

2026-05 · Polish + scale

Late May 2026

  • Dashboard, admin/devices, admin/users now paginate + searchable — scales to fleets with 100+ primary + 1M+ sub-devices without DOM blowup.
  • Sub-devices visible as nested chips on primary device rows with humanCount short-form labels ("↳ 1.2M sub").
  • Admin can read-only view any customer device via /devices/{id} with explicit ADMIN VIEW banner; mutation forms hidden.
  • /check?target= reachability probe live — SSRF-safe TCP-connect from the hub to your customer-pool IPv6, returns OK / FAIL with diagnostic hints.
  • /wiki rewritten: now includes Compare cards (vs cloudflared / tailscale / zerotier) and proper JSON-LD CollectionPage + ItemList for AI discovery.
  • /pricing per-IP chip ($/IP/mo) prominent on every tier card; "BEST $/IP" highlight.
  • Audit log compact responsive layout (was a 6-column table that exploded on phones).

2026-05 · APK self-update + parallel download

Mid May 2026

  • Android in-app self-update: resumable 8-way parallel chunked HTTP Range download, adaptive parallelism on cellular (4 chunks / 45s timeout), per-chunk retry with backoff.
  • APK size dropped 34 MB → ~8 MB via R8 minify + per-ABI splits (arm64-v8a + armeabi-v7a); 32-bit ARM budget phones still supported.
  • Auto-detect device ABI on /downloads/wayangi.apk via UA Client Hints (Sec-CH-UA-Arch / Bitness) so a single URL serves the right binary.
  • APK version monotonic per deploy (env-injected versionCode = epoch seconds).
  • Native VPN tunnel + token persistence + live throughput chart + reboot-survival via foreground service.
  • Brand launcher icon (wayangi favicon).

2026-05 · Install hardening + Linux fixes

Mid May 2026

  • Linux binary now statically linked again — works on Alpine / musl-based distros that lack /lib64/ld-linux-x86-64.so.2.
  • install.sh: mkdir -p $INSTALL_DIR before write (fixes fresh Apple Silicon macOS that lacks /usr/local/bin), auto-strips com.apple.quarantine, installs launchd plist for reboot survival.
  • install.ps1: clears Mark-of-the-Web via Unblock-File after install.
  • install.sh download progress bar (was silent — users thought it was stuck).
  • Manifest signing: ed25519-signed manifest mandatory for self-update; offline signing key via cmd/wayangi-sign.

2026-05 · Sub-devices + transport fallback

Early May 2026

  • Sub-devices: child /128 entries carved from a parent's paid prefix. Buy a /124 once, run wayangi on 16 different machines — each auto-claims one IPv6.
  • TCP transport fallback: when UDP/443 is blocked, agent auto-falls-back to WireGuard tunneled inside WSS over TCP/443 through Cloudflare.
  • Per-device monthly RX/TX accounting in /admin/usage.

2026-04 · Free tier + audit log

April 2026

  • Free mesh-only tier: 3 devices per account, private mesh, no public IPv6, no credit card.
  • Audit log table + /admin/audit + /admin/security correlation view (token-rotate followed by force-rebind from different IP within 5 min flagged as account-takeover pattern).
  • Session tokens SHA-256 hashed in storage (was plaintext).
  • Xendit payment integration (cards, IDR bank transfer, GoPay, OVO).

2026-03 · Pricing rework

March 2026

  • USD pricing rolled out (was IDR-only).
  • Annual cadence with 15% savings vs monthly equivalent.
  • All 8 tiers visible at /pricing — no contact-sales gating.

Earlier

Initial scaffold of wayangi: WireGuard data plane on UDP/443, dual-stack tunnel (IPv4 + IPv6 link-layer), /128 single-address + /64 prefix-delegation tiers, hub on dalang.io's Jakarta VM, AS-routed /48 announced via MikroTik upstream.