Grant Proposal: Maze Linux – NymVPN integration and per-app mixnet routing

Nym Squad League Phase 1: Proposals
1

About me and the project

I’m Berk, the developer of Maze Linux (https://mazelinux.berkkucukk.com.tr, source: GitHub - berk-kucuk/Maze-Linux · GitHub), an open-source, Arch-based desktop distribution focused on security and privacy. It ships a hardened KDE Plasma desktop with a full UEFI Secure Boot chain, AppArmor, firewalld and USBGuard, Tor integration with per-app Tor routing, and an amnesic Tor-only “Ghost” session.

Today about 635 systems per week use our package repository, ISO downloads are growing 2-3x per month, and we’ve shipped 20 releases since June 2026. I work on Maze Linux full-time.

The problem

NymVPN already runs on Linux and has official Arch packages, but two things are missing for privacy-focused desktop users:

  1. Integration with a hardened desktop. On a system with a strict firewall, systemd-resolved, AppArmor and Secure Boot, a VPN daemon needs testing and configuration to work reliably without DNS leaks. Users of hardened distributions currently have to figure this out themselves.
  2. Per-app routing. NymVPN routes the whole system. Many users want only specific apps (a browser, a messenger, a wallet) to go through the mixnet while the rest of the system uses the normal network, the same way Maze Linux already offers per-app Tor.

Clients only, never nodes

Maze Linux users will only ever connect to Nym as clients. Maze will never run a Nym node, relay other people’s traffic or use users’ resources on their behalf; running a node stays a deliberate choice for operators. We hold ourselves to the same rule for any network we integrate.

Deliverables

Milestone 1 — NymVPN on Maze Linux (month 1)

  • NymVPN (daemon, desktop app, CLI) one-click install from the Maze Store and our signed package repository, built on Nym’s official packages
  • Verified to work with Maze’s hardening (firewalld, systemd-resolved, AppArmor, Secure Boot) with no DNS or IPv6 leaks, with any required configuration shipped by default
  • Leak-test results published, and NymVPN added to our per-release test checklist
  • Nym Wallet available as a one-click install from the Maze Store
  • NYM support in Maze Crypto, our open-source watch-only portfolio app (36 networks, already supports Cosmos): users can track native NYM on Nyx by n1… address, with no private keys in the app

Milestone 2 — Per-app mixnet routing (months 2-3)

  • Feasibility step: route a single app through the Nym mixnet using the rootless network-namespace design Maze already uses for per-app Tor with a Nym SOCKS5 client as the backend
  • “Run through Nym” option in Entropy Shield (Maze’s privacy control app) next to “Run through Tor”: DNS handled inside the mixnet, everything else in the namespace blocked by default
  • Released as open source (GPL-3.0) in our signed repository, so it also works on any Arch-based system that installs the package

Fallback: if the feasibility step shows that per-app routing over the mixnet isn’t reliable enough for everyday use, Milestone 2 will instead deliver a system-wide NymVPN mode in Entropy Shield (connect/disconnect, status, and automatic switching off of Entropy Shield’s system-wide Tor mode so the two never run at the same time). I’ll report the feasibility result on the forum before continuing, and the milestone budget can be reduced to match the smaller scope.

Milestone 3 — Documentation and launch (month 3)

  • User guide: setting up NymVPN on Maze Linux, and when to use Nym vs. Tor per app
  • Technical write-up of the per-app routing design and leak tests
  • Release announcement on our blog and in the Nym forum

Open questions for the Nym team

  • Per-app routing would use a SOCKS5 client against Nym’s exit gateways. Will this need zk-nym bandwidth credentials in the future, and would you prefer it to work with NymVPN subscriptions/credentials from the start? I’d be happy to design it that way so it brings users to NymVPN.
  • Are there exit policies or rate limits on network requesters that I should design around?

Timeline

3 months from approval. I’ll post a progress report on the forum (Phase 2: Reporting) at the end of each milestone.

Budget

35,000 NYM total

  • Milestone 1 — integration, hardening, leak testing, Nym Wallet and Maze Crypto support: 8,000 NYM
  • Milestone 2 — per-app mixnet routing: 20,000 NYM
  • Milestone 3 — documentation and launch: 7,000 NYM

Maintenance

I’ll keep the NymVPN integration and the Entropy Shield Nym mode working with new NymVPN and Maze Linux releases for at least 12 months after completion, as part of Maze’s regular release testing.

Links