> For the complete documentation index, see [llms.txt](https://docs.netsepio.com/latest/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.netsepio.com/latest/erebrus/readme.md).

# Introduction to Erebrus

Erebrus is a decentralized VPN (DePIN) that protects your privacy and security with no hidden tracking or logging. Anyone worldwide can run a node — on a physical server or a VM — and earn incentives, helping build a censorship-resistant network.

For more details visit [erebrus.io](https://erebrus.io).

## Features

* WireGuard fast path with a SQLite-backed, race-free peer store.
* **Stealth carriers** for restrictive networks: when WireGuard's UDP is throttled or DPI-blocked, the same tunnel is wrapped in an embedded sing-box transport that looks like ordinary internet traffic:
  * **VLESS + REALITY** (`:443/tcp`) — presents as a real TLS session to a borrowed SNI.
  * **Hysteria2** (`:443/udp`) — QUIC/HTTP3 with optional Salamander obfuscation.
* libp2p identity + DID (`did:erebrus:<peerId>`) derived from a mnemonic.
* Optional **Erebrus Drop** storage: a pinned Kubo/IPFS sidecar with a separate mnemonic-derived libp2p identity and persistent local pins.
* HTTP REST API (`/api/v2`) and Prometheus `/metrics`.

## Install a node

Linux only (x86\_64 / arm64). A node needs a **static, internet-routable public IP**, real bandwidth, and open ports (`9080/tcp`, `51820/udp`, `443/tcp`, `443/udp`, `9002/tcp`). Drop nodes additionally publish `4001/tcp+udp` for the IPFS swarm. The installer verifies the required TCP ports.

```bash
curl -fsSL https://erebrus.io/install.sh | bash
```

Non-interactive example:

```bash
curl -fsSL https://erebrus.io/install.sh | \
  MNEMONIC="..." \
  EREBRUS_ACCESS=public \
  EREBRUS_NODE_REGISTRATION_TOKEN="ere_reg_..." \
  bash -s -- --drop --yes
```

The installer detects the public IP and uses it as `WG_ENDPOINT_HOST`. Set `WG_ENDPOINT_HOST` explicitly only to override the detected public IP; NAT port forwarding remains the operator's responsibility.

Drop is optional, works with the Standard, Shield, and Sentinel Docker profiles. Use `--no-drop` to stop the sidecar without deleting its persistent data. Files are accessed only through the authenticated Erebrus gateway.

## Build from source

The REALITY server requires a build tag, wired into the Makefile and Dockerfile:

```bash
make build      # go build -tags with_utls -o erebrus ./cmd/erebrus
make test
```

## Dashboard

Every node serves a local dashboard at `http://<node>:9080/` — intro, live stats (connected users, bandwidth, throughput, uptime), and the API reference. It reads only public, coarse aggregates (`/api/v2/status`, `/api/v2/stats`).

## Docs

* [docs/NODE.md](/latest/erebrus/node.md) — running, configuring, and managing a node (ports, env reference, troubleshooting).
* [docs/ARCHITECTURE.md](/latest/erebrus/architecture.md) — package layout and the stealth carrier topology.
* [docs/SECURITY-AUDIT.md](/latest/erebrus/security-audit.md) — data-capture inventory, threat model, and operator hardening.
* [docs/DROP.md](/latest/erebrus/drop.md) — Drop installation, private APIs, metrics, and safe storage operations.
* [docs/node-api.openapi.yaml](https://github.com/NetSepio/erebrus/tree/main/docs/node-api.openapi.yaml) — the `/api/v2` REST contract.

The REST surface lives under `/api/v2` (status, stats, peers CRUD, credentials, and gateway-private Drop operations); node status is public at `GET /api/v2/status`.