- Rust 68.9%
- Kotlin 14.6%
- Python 11%
- Shell 1.9%
- C 1.4%
- Other 2.1%
f9a623e076
The resource cache deliberately skips watching root-owned files that only root may write, so two telltale-linux tests that rewrite their own fixtures fail when cargo runs as root. Run fmt, clippy and the tests as the image's builder user, as makepkg does in the package build. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> |
||
|---|---|---|
| .forgejo/workflows | ||
| android | ||
| assets/readme | ||
| crates | ||
| docs | ||
| ebpf | ||
| gnome | ||
| packaging | ||
| scripts | ||
| tests | ||
| vendor/nfq | ||
| website | ||
| .editorconfig | ||
| .gitignore | ||
| AGENTS.md | ||
| Cargo.lock | ||
| Cargo.toml | ||
| README.md | ||
| rustfmt.toml | ||
Telltale
Every app asks before it talks to the network.
Download • Android • GNOME • Matrix
Community
Discussion happens in #projects:salix.host, which works from any Matrix client. If you do not have an account yet, you can create one on salix.host, my public homeserver: federated, encrypted by default, and no email address required.
Download Telltale
Android
Obtainium is the recommended option because it installs updates directly from Telltale releases. The APK button opens the latest release for a manual download. Stable and nightly builds are also published to the Salix F-Droid repository; the nightly installs beside the stable app as Telltale Nightly. Telltale needs Android 10 or newer, does not need root, and is not available through Google Play.
Linux
Telltale for GNOME is packaged for Arch Linux on x86_64. The installer downloads the latest
package from the releases page, verifies its
checksum and installs it. On a first install it shows the proposed configuration and enables
filtering only after you confirm. Running it again updates Telltale and restarts its services.
curl -fsSL https://git.salix.host/salix/telltale/raw/branch/master/scripts/install-arch.sh | bash
Add -s -- --nightly after bash for the rolling nightly built from every push to master, or
-s -- --strict-dns to keep per-app decisions for DNS too. Enforcement needs a recent kernel with
an active BPF LSM; see kernel requirements and
tested coverage before enabling it on a daily-use system. To build from source
or try the app in demo mode without touching your network, see the GNOME guide.
Screenshots
Description
Telltale is an ask-first application firewall. When an app opens a connection Telltale has not seen before, the connection waits while you decide: allow or deny, for this destination or anywhere, for one connection, a while, or for good. Nothing is denied behind your back, and rules belong to the verified app rather than to its name.
There is a GNOME desktop app and an Android app. They share one Rust policy engine so rules, profiles and routes behave the same way underneath, while each enforces them with what its platform offers: the kernel on Linux, a local VPN on Android.
Features
- Ask first, decide once. A compact prompt shows the app, its destination and the choices that matter: scope, duration — from one connection up to permanently, including one hour — and route. An app's page sets its whole internet access in one switch: ask, allow all, or block. Pending requests wait until you answer them, and every rule can be edited, disabled or revoked later.
- Rules follow the real app. On Linux, a kernel socket proof ties each connection to a verified application, including browser helpers, Electron apps and Flatpaks. On Android, rules follow the package and its signing certificate, so another app reusing the name does not inherit them.
- Enforced where it counts. The desktop daemon gates outbound TCP and UDP with nftables, NFQUEUE and eBPF, and fails closed: stopping or crashing it keeps the gate shut until you recover deliberately. Android needs no root.
- A route per app. Send an app through an imported WireGuard tunnel or Tor, with
.onionsupport through the embedded Arti client. A default route covers apps without their own, and apps you allow can also reach a Tailnet: the embedded Tailscale node runs on Android and the desktop (TCP only there). Routed traffic blocks instead of leaking when its tunnel is down. - Blocklists and private DNS. Subscribe to blocklists from a catalog or your own URLs, and use managed DNS over TLS so lookups do not leave in the clear.
- Traffic you can see. Per-app history with charts, upload and download counters, and an offline map of where connections go. History stays in a local SQLite database and no external IP lookup is ever made.
- Profiles for every network. Keep independent rule sets for home, travel or work, switch between them by hand or automatically by network, and move rules between devices with reviewed JSON import and export.
Projects
| Project | Best for | Built with | How to get it |
|---|---|---|---|
| GNOME | Arch Linux desktops | Rust, GTK 4, libadwaita, eBPF, nftables | Arch package from the releases page via the installer |
| Android | Phones and tablets, without root | Kotlin, Compose, Rust | APK via Obtainium, the releases page or the Salix F-Droid repository |
| Policy engine | Everything shared | Rust, SQLite | Used by the apps above |
The GNOME app lives in gnome/ with its daemon and backend (telltaled, telltalectl) in
crates/, the Android app in android/ with its Rust backend in crates/android. Each guide covers install, build, coverage
limits and what is actually implemented today.
Contributions
I'm not currently accepting contributions, but issues are welcome for bug reports, feature ideas, and other feedback.
Releases
Releases use a shared vMAJOR.MINOR.PATCH tag on a commit named Release Telltale MAJOR.MINOR.PATCH.
Pushing the tag runs .forgejo/workflows/release.yml, which checks that the workspace, Android and
Arch package versions match, builds the signed Android APK and the Arch package, publishes the APK to
the Salix F-Droid repository, and creates one Forgejo release with both files and their SHA-256
checksums.
Between releases, every push to master builds nightlies. arch-nightly.yml replaces the rolling
nightly pre-release that the installer's --nightly option uses, and android-nightly.yml
publishes host.salix.telltale.devel to the F-Droid repository.
Disclaimer and license status
Telltale is a personal project, built for daily use and experimentation. Telltale, its source code, and all downloadable builds are provided as is, without warranties of any kind, express or implied. You use them entirely at your own risk. To the fullest extent permitted by applicable law, the author will not be liable for any claim, loss, damage, data loss, service interruption, loss of network access, or other consequence resulting from the use, misuse, or inability to use Telltale.
A firewall that fails closed can cut off your network. Keep local terminal or TTY access available when enabling enforcement, and read the coverage limits first: Telltale does not protect other users, containers, or traffic hidden behind proxies and Unix IPC.
No support commitments, compatibility guarantees, or release schedule are provided. You are responsible for complying with applicable laws and third-party terms when using Telltale. The project is not affiliated with Little Snitch, Objective Development, WireGuard, the Tor Project, or Tailscale.
The code is source available for reading and reference. It is not open source licensed, so unless a license is added later, no permission is granted to reuse, redistribute, or relicense it.