Menu

Docs

Getting started

  1. Install the Keena app on your Android phone.
  2. Create your account. On the phone, open keena.network/signup, choose "Create account with passkey", choose Keena, and use your fingerprint. On a computer, scan the QR code with the app (Wallet tab → "Scan QR code").
  3. Back up. In the app, open Menu → "Back Up to File".
  4. Add a connector.
  5. Add the test service.
  6. Connect from your phone.

Install a connector

Open keena.network → Connectors. Type a name and choose "Add connector". Approve on your phone. Copy the Docker command (or choose "Linux (no Docker)"). Run it on the host within 60 minutes. It works once. Then the connector shows Online.

You need Linux (amd64 or arm64) with Docker, or Debian or Fedora for the package.

Docker command example

docker run -d --name keena-homelab --restart unless-stopped --cap-drop ALL --cap-add NET_ADMIN --cap-add NET_BIND_SERVICE --cap-add NET_RAW --device /dev/net/tun --read-only --sysctl net.ipv6.conf.all.disable_ipv6=0 --sysctl net.ipv6.conf.default.accept_dad=0 -v keena-homelab:/var/lib/keena -e KEENA_TOKEN=<token from the Connectors page> ghcr.io/ehanoc/keena-connector:0.2.0@sha256:815b85911f71195cae7d67ce1537ba85980fde8b6373010234fcc867dbb418cf

The Connectors page shows the real command with your token.

Add services

Choose "Add test resource" and approve on the phone. You get hello.<connector>.keena. The connector itself serves this test page. Nothing on your network is exposed.

Choose "Add resource" for a real service. Fill in Name (like nas.home.keena), Port, Target host (the address as the connector host sees it) and Target port. The Free plan allows 5. Removing a service needs phone approval.

Connect from your phone

In the Keena app, open Connection and tap Connect. Accept Android's VPN dialog once. The app shows "Connected · Direct" or "Connected · Relay". Tap Open, or type the name in the browser. Other apps and websites work as before.

Upgrade a connector

On the Connectors page, choose Upgrade. It shows two commands: remove the container, then run the new image. The volume keeps the identity. You need no new token.

Troubleshooting

  • Still connecting: check that the connector is Online.
  • Private DNS: set it to Automatic or Off.
  • Browser "Not secure" on http:// names: the tunnel is encrypted. Tap "Continue to site".
  • "Your plan allows …": remove one, or wait for paid plans.

How Keena protects you

  • Your keys stay on your phone.
  • You sign every approval on your phone.
  • WireGuard encrypts traffic from end to end.
  • The controller sees metadata only.
  • Relays see only ciphertext.
  • The connector makes outbound connections only.
  • Access is per service.