Own your infrastructure.
Kiwi Network is a privacy-first, self-hosted setup for individuals, SMBs, and public offices — built on open-source and Linux.
One WireGuard entry point. Everything else behind the VPN.
What you get
A minimal attack surface with maximum flexibility.
kiwi-master
The hardened public entry point. Only WireGuard is exposed to the Internet.
- wg-easy (WireGuard server)
- gluetun (upstream VPN / double-hop)
- pihole (DNS filtering)
- Optional Tor proxy
kiwi-node
Private services reachable only via VPN or LAN. Never publicly exposed.
- Nextcloud (AIO)
- Vaultwarden
- Reverse proxy (NGINX)
- Docker services
kiwi-workstation
Daily driver OS for users and operators. Easy onboarding, safe defaults.
- Fedora Silverblue / Bluefin DX
- Immutable base
- VPN-first workflows
- Simple updates & rollback
Network Architecture
How traffic flows through a Kiwi Network deployment.
Federation (Planned)
Connect multiple Kiwi Networks for secure collaboration.
Share files and calendars across organizations without exposing services publicly.
Define exactly which services and users can communicate between networks.
All inter-network traffic travels through encrypted VPN tunnels.
Ready to get started?
Check out the documentation or explore the source code on GitHub.