Clarify Linux Protun TCP integration

[tassa-yoniso-manasi-karoto]

Hi,

I am trying to understand how this repository is intended to be used by the Linux Proton VPN client.

My goal is to use Proton WireGuard over TCP port 443 on Linux, with country or specific server selection. I am not trying to use Stealth.

Context:

1. The Proton VPN Winter 2025 and 2026 roadmap mentions a new VPN architecture for Linux.
2. This public protun repository appears to be part of that new architecture ... I guess?
3. The Linux client has separate protocol names for protun-tcp and protun-tls, so I am trying to clarify the TCP transport specifically, not Stealth or TLS obfuscation.

What I found:

1. python-proton-vpn-api-core has Protun protocol classes for protun-tcp, protun-tls, protun-udp, and protun-auto.
2. The Linux Python client expects a NetworkManager VPN plugin named protun with service org.freedesktop.NetworkManager.protun.
3. On Arch Linux, current Proton VPN packages expose the Python glue, but ProtunTCP.validate() returns False because NetworkManager does not list a protun VPN plugin.
4. This repository appears to provide the transport core library. It exposes unix_connect, which expects a TUN file descriptor, but I do not see the NetworkManager plugin, service file, or Linux runner that creates and configures the TUN device.
5. The Proton client config advertises WireGuard TCP port 443, so the server side seems to support this transport.

Questions:

1. Is there a public Linux NetworkManager plugin or service that uses this repository?
2. If not, is Linux desktop Protun support private, not yet released, or handled by a different repository?
3. Is protun-tcp the non obfuscated WireGuard over TCP transport advertised as WireGuard TCP port 443 in the client config?
4. Is this crate meant to be used directly by third party Linux clients by creating a TUN device and calling unix_connect?
5. Are there docs for the expected Linux routing and DNS setup around Protun TCP?

Thanks.