Dashboard manual
The tray menu
Left-clicking the tray icon hides the window, so for a lot of daily use this menu is the dashboard. It carries its own copy of the controls that matter, it reports the machine’s state in six readings at the top, and it can connect a tunnel, route the system through Tor, change your hardware address, wipe browser data or shut the machine down while the window is nowhere on screen.
System trayNo window needed96 rowsRead from the source
MANUALStartupAutoShieldCircleLite ClassicColonyOpsSOCVitalsSettingsGuides and wizardsTray menuShared controls
Why there is no walkthrough here The tray menu has no web page behind it. It is built in the application’s Rust, as a native menu the desktop draws, so there is nothing for this manual’s capture harness to photograph or measure: every other page here is a real render of a real screen, and this one cannot be. The rows below are read directly out of the source that builds the menu, most explanations start from the description of the command that row runs, rewritten for a first-time reader where the product’s wording assumed too much, and a check in the build refuses if that source changes and this page does not.
The menu itself, 16 rows
The first six rows are readings, not controls: they are disabled by design and carry the live login, VPN, Tor, IP, tunnel, DNS and identity state so you can check the machine without opening anything. Everything below them acts.
| # | Control | What it does |
|---|---|---|
| 1 | Kodachi , checking... | The first reading. It says Kodachi followed by what is protecting you right now: VPN + Tor, VPN (Kodachi network), VPN, Tor or no tunnel. It is rewritten every ten seconds and is disabled because it is a label, not a control. |
| 2 | Login: ... VPN: ... Tor: ... | Login, VPN and Tor state on one line. Disabled: it reports, it does not act. |
| 3 | IP: checking... | Your public address as the last probe saw it. Disabled: a reading. |
| 4 | Tunnel: checking... | Which tunnel is up, if any, and through what. Disabled: a reading. |
| 5 | DNS: checking... | Which resolver is answering and whether it is encrypted. Disabled: a reading. |
| 6 | Host: ... MAC: ... TZ: ... | Host name, hardware address and timezone as the machine currently presents them. Disabled: a reading. |
| 8 | Show Dashboard | Brings the window back. Left-clicking the tray icon hides it, and this is the way to get it on screen again. |
| 9 | Dashboardsubmenu | Opens the Dashboard group: 4 rows, further down this page. |
| 11 | Connectsubmenu | Opens the Connect group: 16 rows, further down this page. |
| 12 | Protectionsubmenu | Opens the Protection group: 8 rows, further down this page. |
| 13 | Network / DNSsubmenu | Opens the Network / DNS group: 11 rows, further down this page. |
| 14 | Identitysubmenu | Opens the Identity group: 8 rows, further down this page. |
| 15 | Sessionsubmenu | Opens the Session group: 4 rows, further down this page. |
| 17 | Dangersubmenu | Opens the Danger group: 5 rows, further down this page. |
| 19 | Login | Signs you in with the account saved on this machine and keeps the session alive by signing in again automatically when it expires. Once you are signed in the row reads Logout and clicking it ends the session. Nothing in this menu is hidden while you are signed out, but about forty rows run a command that refuses without a session, so they fail quietly until you sign in here or in the window. runs online-auth authenticate --relogin, or online-auth logout when signed in |
| 20 | Quit Kodachi | Quits the dashboard. Any tunnel, Tor routing and DNS (Domain Name System) setting the background services hold stays exactly as it is. The only things that stop are the WatchGuard watchers the dashboard itself started, and their saved state is cleared so the next start begins clean. |
Dashboard, 9 rows
Opens one of the startup surfaces in the window. These change nothing on the machine. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.
| # | Control | What it does |
|---|---|---|
| 1 | Launcher (Simple) | Opens the simple Quick Launch picker inside the window. |
| 2 | Advanced Setup | Opens the Advanced setup screen inside the window. Its tabs are Launch (readiness and launch settings), Advanced, Mobile (pairing a phone), AutoShield, About and Terms. It changes nothing on the machine. |
| 3 | AutoShield | Opens the same Advanced setup screen with its AutoShield tab already selected. AutoShield is the boot automation you can arm to run a set of actions at every start. It is a tab on that screen, not a separate window. |
| 4 | Setup Wizard | Opens the Routing Guide, the wizard that recommends a protocol mix for what you are trying to do. |
| 5 | Switch to Circleadded at runtime | Switches the window to Circle, the single-ring quick view. This row is added by the application at start-up from its dashboard list rather than written in the tray source, so it appears below the four rows above. |
| 6 | Switch to Lite Classicadded at runtime | Switches the window to Lite Classic, the complete control workspace. This row is added by the application at start-up from its dashboard list rather than written in the tray source, so it appears below the four rows above. |
| 7 | Switch to Vitalsadded at runtime | Switches the window to Vitals, the live system monitor. This row is added by the application at start-up from its dashboard list rather than written in the tray source, so it appears below the four rows above. |
| 8 | Switch to SOCadded at runtime | Switches the window to SOC, the security operations monitor. This row is added by the application at start-up from its dashboard list rather than written in the tray source, so it appears below the four rows above. |
| 9 | Switch to ColonyOpsadded at runtime | Switches the window to ColonyOps, the workflow operator mode. This row is added by the application at start-up from its dashboard list rather than written in the tray source, so it appears below the four rows above. |
Connect, 16 rows
One row per protocol routing-switch accepts, drawn as a radio because the tick is a real probe off routing-switch status rather than a guess. Auto-select picks by a static score table, not by measuring your network now. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.
| # | Control | What it does |
|---|---|---|
| 1 | Auto-select best protocol | Picks a protocol for you and connects with it. The choice comes from a fixed score each protocol carries on your account card, not from testing your network now, and the obfuscated transports (AmneziaWG and OpenVPN over Cloak) are left out unless you ask for them. Needs sign-in, because the protocol list and the server details come from your account. runs routing-switch auto-select |
| 3 | WireGuardone of a set | Connects WireGuard: a modern VPN protocol with a minimal attack surface, excellent performance and low latency, using ChaCha20 and Curve25519. The practical starting point for most users; if it is blocked or slow, benchmark the alternatives. One of a set: the tick marks the protocol a probe of routing-switch status found active, and choosing another asks routing-switch connect to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect wireguard |
| 4 | Hysteria2one of a set | Connects Hysteria2: a UDP protocol built on QUIC with its own congestion control, optimised for unstable or high-latency links such as mobile connections. On a clean link it buys you nothing over WireGuard. One of a set: the tick marks the protocol a probe of routing-switch status found active, and choosing another asks routing-switch connect to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect hysteria2 |
| 5 | OpenVPNone of a set | Connects OpenVPN: the mature, battle-tested VPN protocol, highly configurable, TCP or UDP, with full certificate validation. The one to fall back to when WireGuard will not connect through a fussy firewall. One of a set: the tick marks the protocol a probe of routing-switch status found active, and choosing another asks routing-switch connect to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect openvpn |
| 6 | AmneziaWGone of a set | Connects AmneziaWG: WireGuard with its recognisable handshake disguised by junk packets and randomised headers, to get past networks that block plain WireGuard. Same speed class once connected, but it costs bandwidth, needs its own kernel module, cannot talk to a stock WireGuard peer, and sits outside the automatic ranking. Try it first when plain WireGuard is blocked. One of a set: the tick marks the protocol a probe of routing-switch status found active, and choosing another asks routing-switch connect to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect amneziawg |
| 7 | OpenVPN over Cloakone of a set | Connects OpenVPN over Cloak: OpenVPN wrapped in a transport that looks like ordinary browser HTTPS to a real decoy website, so a probe that is not a Cloak client is served the decoy. It is TCP inside TCP, which degrades badly on a link that loses packets, so it is the answer when UDP itself is blocked, not the first thing to try. One of a set: the tick marks the protocol a probe of routing-switch status found active, and choosing another asks routing-switch connect to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect openvpn-cloak |
| 8 | Shadowsocksone of a set | Connects Shadowsocks: a lightweight encrypted proxy designed to bypass censorship. Plain Shadowsocks is encrypted proxy traffic, not HTTPS; only a transport plugin adds camouflage, and how well it evades detection depends on the server, cipher, transport and the network in front of you. One of a set: the tick marks the protocol a probe of routing-switch status found active, and choosing another asks routing-switch connect to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect shadowsocks |
| 9 | V2Rayone of a set | Connects V2Ray: the advanced proxy platform behind the VMess family, with multiple protocols and transports. A censorship-bypass tool rather than a faster tunnel. One of a set: the tick marks the protocol a probe of routing-switch status found active, and choosing another asks routing-switch connect to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect v2ray |
| 10 | Xray , VLESSone of a set | Connects Xray VLESS: the lightweight, minimal-overhead protocol of the Xray platform, the cheaper choice when both it and VMess would work. One of a set: the tick marks the protocol a probe of routing-switch status found active, and choosing another asks routing-switch connect to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect xray-vless |
| 11 | Xray , VLESS Realityone of a set | Connects Xray VLESS with Reality: VLESS with enhanced obfuscation that mimics TLS to real websites, for networks that inspect traffic closely. One of a set: the tick marks the protocol a probe of routing-switch status found active, and choosing another asks routing-switch connect to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect xray-vless-reality |
| 12 | Xray , Trojanone of a set | Connects Xray Trojan: an HTTPS-based protocol whose traffic appears as normal web traffic to a network watching it. One of a set: the tick marks the protocol a probe of routing-switch status found active, and choosing another asks routing-switch connect to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect xray-trojan |
| 13 | Xray , VMessone of a set | Connects Xray VMess: the fully encrypted Xray protocol with UUID authentication; heavier than VLESS. One of a set: the tick marks the protocol a probe of routing-switch status found active, and choosing another asks routing-switch connect to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect xray-vmess |
| 14 | Mieru (Mita)one of a set | Connects Mieru (Mita): a lightweight proxy for specific use cases, built to evade deep packet inspection. Reach for it when the more common transports are recognised and blocked. One of a set: the tick marks the protocol a probe of routing-switch status found active, and choosing another asks routing-switch connect to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect mita |
| 15 | Dante (SOCKS5)one of a set | Connects Dante, a SOCKS5 proxy with username and password authentication. A proxy, not a full tunnel: it routes what is pointed at it, which is useful for one application, and does not cover the whole machine. One of a set: the tick marks the protocol a probe of routing-switch status found active, and choosing another asks routing-switch connect to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect dante |
| 16 | Tor (redsocks)one of a set | Connects the Tor route through redsocks, a local transparent proxy that sends traffic into the Tor network so applications need no Tor settings of their own. Slower than any VPN: the product's own words are that slower speeds provide stronger anonymity through multiple encrypted relays. One of a set: the tick marks the protocol a probe of routing-switch status found active, and choosing another asks routing-switch connect to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect tor |
| 18 | Disconnect | Safely disconnect from all proxy protocols and restore direct internet access. Your traffic will no longer be encrypted through external servers runs routing-switch disconnect |
Torrify, 5 rows
Send the whole machine through Tor, and the DNS half separately. Detorrify is the way back, and nothing is anonymised once it runs. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.
| # | Control | What it does |
|---|---|---|
| 1 | System via Tor (single instance) | Routes every connection this machine makes through one Tor instance, using nftables firewall rules. It does not move your DNS (Domain Name System) lookups into Tor; the Tor DNS rows two lines below do that separately. Needs sign-in. runs tor-switch torrify-system-nftables |
| 3 | Tor DNS | A tick that reports whether DNS (Domain Name System) lookups go through Tor. Clicking it starts or stops Tor DNS with nftables. Starting needs sign-in; stopping works signed out. runs tor-switch start-tor-dns-nftables, or stop-tor-dns-nftables |
| 4 | Start Tor DNS | Sends every DNS (Domain Name System) lookup through Tor, so the names of the sites you visit are resolved inside the Tor network instead of by your local resolver. Uses nftables firewall rules. Needs sign-in. runs tor-switch start-tor-dns-nftables |
| 5 | Stop Tor DNS | Stops sending DNS (Domain Name System) lookups through Tor and removes the nftables rules that did it. Your normal resolver takes over again. Works signed out. runs tor-switch stop-tor-dns-nftables |
| 7 | Detorrify system | Takes the whole machine back off Tor. Two commands run in order: the nftables rules that route everything through Tor are removed first so connectivity comes back, then the legacy iptables rules are cleaned up. System traffic no longer goes through Tor once it has run; any VPN tunnel you have up is unaffected. runs tor-switch detorrify-system-nftables, then detorrify-system-iptables |
Tor daemon, 6 rows
The Tor service itself, and circuit rotation. A new circuit changes the exit, never who you are signed in as. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.
| # | Control | What it does |
|---|---|---|
| 1 | Start Tor | Starts the Tor service. This makes the Tor network available for anonymous browsing and for the other Tor rows in this menu. Needs sign-in. runs tor-switch start-tor |
| 2 | Stop Tor | Stop the Tor service completely. All Tor connections will be terminated and the daemon will shut down runs tor-switch stop-tor |
| 3 | Restart Tor | Stops and starts the Tor service again. Use it when Tor stops responding or after changing its settings. Needs sign-in. runs tor-switch restart-tor |
| 5 | New Tor Circuit | Asks Tor for a new circuit, so your traffic leaves through a different exit and shows a different public address. Who you are signed in as does not change. Needs sign-in. runs tor-switch new-tor-circuit |
| 6 | New Circuit, All Instances | Asks every running Tor instance for a new circuit at once. Useful when the system is load balanced across several instances. Needs sign-in. runs tor-switch new-tor-circuit-all |
| 8 | Clear Exit Node | Removes any country restriction on the Tor exit, so Tor picks exits by speed and availability again. Needs sign-in. runs tor-switch clear-exit-node |
Auto IP change, 4 rows
Rotate the Tor circuit on a timer. Useful for anonymity, awkward for anything holding a session open. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.
| # | Control | What it does |
|---|---|---|
| 1 | Every 10 minutes | Requests a new Tor circuit every ten minutes, so your exit address keeps changing. The menu cannot show which interval is armed, so these rows carry no tick. Needs sign-in. runs tor-switch auto-ip-change 10m |
| 2 | Every 30 minutes | Requests a new Tor circuit every thirty minutes. The exit changes each time; who you are signed in as does not. Needs sign-in. runs tor-switch auto-ip-change 30m |
| 3 | Every hour | Requests a new Tor circuit every hour. The exit changes each time; who you are signed in as does not. Needs sign-in. runs tor-switch auto-ip-change 1h |
| 5 | Off | Stops the automatic circuit timer. Your current Tor circuit stays until you change it by hand. Needs sign-in. runs tor-switch stop-auto-ip-change |
Protection, 8 rows
The three at-a-glance states, the routing submenus, and the blunt internet cut. The tick boxes report what is on; they are not a wish list. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.
| # | Control | What it does |
|---|---|---|
| 1 | VPN | A tick that reports whether a tunnel is up, and the label names the live protocol when one is. Clicking it while nothing is up connects with WireGuard, always, which is why the row then reads VPN (connects WireGuard); pick any other protocol from the Connect group. Clicking it while a tunnel is up disconnects. Connecting needs sign-in; disconnecting does not. runs routing-switch connect wireguard, or routing-switch disconnect |
| 2 | System via Tor (load balanced) | A tick that reports whether the whole system is routed through Tor. Clicking it while off runs two commands: it sets round-robin load balancing across several Tor instances, then routes everything through them with nftables rules. Clicking it while on takes the machine back off Tor, removing the nftables rules first and then any older iptables rules. Turning it on needs sign-in; turning it off does not. runs tor-switch set-load-balancing-mode round-robin then torrify-system-nftables-load-balanced, or detorrify-system-nftables then detorrify-system-iptables |
| 3 | System hardened | A tick that shows when more than half of the hardening checks pass. Clicking it while off applies the standard hardening profile, the soft one that breaks nothing. Clicking it while on reverts the hardening while keeping the framework ready to re-apply. Both directions need sign-in. runs health-control security-harden, or health-control security-recover |
| 5 | Torrifysubmenu | Opens the Torrify group: 5 rows, further down this page. |
| 6 | Tor daemonsubmenu | Opens the Tor daemon group: 6 rows, further down this page. |
| 7 | Auto IP changesubmenu | Opens the Auto IP change group: 4 rows, further down this page. |
| 9 | Block Internet | Blocks all internet traffic at once, using the best firewall method available on this machine (nftables, iptables or ufw). No confirmation, on purpose, because this is the control you reach for in a hurry. It needs sign-in, so when you are signed out the click refuses and nothing is blocked. Unblock Internet is the way back. runs health-control block-internet |
| 10 | Unblock Internet | Removes every block the row above put in place and lets traffic flow again. It is also the way back after Panic Soft. Works signed out, no confirmation. runs health-control unblock-internet |
DNS category, 4 rows
Each row switches the machine to three random servers drawn from that pool right away, and needs a signed-in session. The Random row in the Network group picks from the reputable pool. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.
| # | Control | What it does |
|---|---|---|
| 1 | Reputable | Switches the system to three servers picked at random from the Reputable pool, the well known providers. It changes your DNS (Domain Name System) settings right away. Needs sign-in. runs dns-switch switch --category reputable |
| 2 | Normal | Switches the system to three servers picked at random from the Normal pool, the ordinary public providers. It changes your DNS (Domain Name System) settings right away. Needs sign-in. runs dns-switch switch --category normal |
| 3 | Fallback | Switches the system to three servers picked at random from the Fallback pool, the emergency set Kodachi ships for when everything else fails. It changes your DNS (Domain Name System) settings right away. Needs sign-in. runs dns-switch switch --category fallback |
| 4 | Remotely fetched | Switches the system to three servers picked at random from the Remotely fetched pool, the list Kodachi fetched from its own server. It changes your DNS (Domain Name System) settings right away. Needs sign-in. runs dns-switch switch --category remotely_fetched |
Network / DNS, 11 rows
Encrypted DNS, filtering, and the recovery actions for when the network stops working. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.
| # | Control | What it does |
|---|---|---|
| 1 | Switch to DNSCrypt | Points the system resolver at DNSCrypt, so every DNS lookup leaves the machine encrypted and authenticated instead of in plain text. The fallback and category rows below choose which servers; this row chooses the transport. runs dns-switch switch --names dnscrypt |
| 2 | Pi-hole | A tick that reports whether Pi-hole filtering is on. Clicking it on sends every DNS (Domain Name System) lookup on the machine through Pi-hole, not only the browser; clicking it off removes that. It refuses while a third-party VPN application owns your DNS, and it needs Pi-hole to be installed. No sign-in needed. runs dns-switch pihole-enable, or dns-switch pihole-disable |
| 4 | Use Random DNS Server | Picks three servers at random from the reputable pool and makes them your DNS (Domain Name System) resolvers. It is one pick, made when you click; it does not keep rotating afterwards. No sign-in needed. runs dns-switch random |
| 5 | Fallback DNS | Switches to the emergency resolver set built into Kodachi, the one to reach for when name resolution is broken. No sign-in needed. runs dns-switch fallback |
| 6 | DNS categorysubmenu | Opens the DNS category group: 4 rows, further down this page. |
| 8 | Fix DNS | Repair broken DNS resolution when websites fail to load after switching DNS modes, toggling VPN, or changing network configuration. Runs health checks and fixes only the stages that are actually broken runs dns-switch fix-dns |
| 9 | Restart DNSCrypt | Restart DNSCrypt proxy without removing config runs dns-switch dnscrypt-restart |
| 10 | Clean DNS Temp Files | Removes the temporary files the DNS service leaves behind. Housekeeping, not a change to how names are resolved. runs dns-switch clean |
| 11 | Restore Default DNS... | Resets the DNS (Domain Name System) server database to the factory list, then makes the built-in fallback resolvers your active servers. Any servers you added by hand and the health history the picker uses to rank servers are deleted, and that cannot be undone. A confirmation opens in the window first. No sign-in needed. runs dns-switch restore-default |
| 13 | Recover Network Routing | Repairs a half-broken routing state after a connect or disconnect that did not finish: it cleans up, restores the routes and resets DNS (Domain Name System). This is the my internet is stuck row. No sign-in needed. runs routing-switch recover |
| 14 | Recover Internet Connection | Works down a ladder of repairs until connections come back: restarting the network manager, clearing the firewall, flushing the route cache, restarting the network interfaces and renewing their addresses, and fixing the resolver file. It skips the repairs when the connection already looks healthy. No sign-in needed. runs health-control recover-internet |
Identity, 8 rows
What the local network can use to recognise this machine: hardware address, host name, clock. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.
| # | Control | What it does |
|---|---|---|
| 1 | Rotate Identity Now... | Asks first, then runs three changes in order: randomizes the MAC (hardware) addresses, sets a random host name, and matches the timezone to your exit country. The MAC step skips the network card carrying your default route, so on a machine with one card only the name and the timezone change; use Force Randomize MACs for that card. The timezone step needs sign-in. runs health-control mac-change-all, then set-random-hostname, then sync-timezone |
| 3 | Randomize MAC Addresses | Gives every network card a new random MAC (hardware) address, except the card carrying your default route, which is skipped on purpose so your connection stays up. On a machine with one network card that means nothing changes and the command says so; Force Randomize MACs is the row that includes it. No confirmation, no sign-in. runs health-control mac-change-all |
| 4 | Force Randomize MACs... | Randomizes every MAC (hardware) address including the card carrying your default route, by taking each interface down first. Your connection drops and any VPN or Tor session dies with it, so reconnect afterwards. A confirmation opens in the window first. Needs sign-in. runs health-control mac-force-change |
| 5 | Reset All MACs... | Puts every network card back on its permanent hardware MAC address, the one that identifies this machine. Active connections drop. A confirmation opens in the window first. No sign-in needed. runs health-control mac-reset-all |
| 7 | Randomize Hostname | Gives the machine a new random host name, the name it announces on the local network. No confirmation, no sign-in. runs health-control set-random-hostname |
| 8 | Restore Default Hostname | Puts the host name back to the Kodachi default: Live-OS on a live boot, Secure-OS on an installed system. Needs sign-in. runs health-control set-default-hostname |
| 10 | Randomize Timezone | Sets the clock to a random timezone, so the time this machine reports no longer matches where you are. No confirmation, no sign-in. runs health-control set-random-timezone |
| 11 | Match Timezone to Exit Country | Sets the clock to the timezone of the country your public address currently belongs to, so the machine's time matches your exit. Needs sign-in. runs health-control sync-timezone |
Session, 4 rows
The window and the desktop, not the machine. Close to tray is what makes this menu the whole interface. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.
| # | Control | What it does |
|---|---|---|
| 1 | Lock Screen | Locks the screen at once, the same as walking away and locking by hand: every application keeps running behind the lock and nothing on the machine changes. It runs health-control lock-screen without administrator rights, asks for no confirmation, and works whether or not you are signed in to Kodachi, because locking is not on the binary's sign-in list. runs health-control lock-screen |
| 3 | Conky desktop widget | Shows or hides the Conky desktop widget, the always-on status panel drawn on the desktop itself. |
| 4 | Compact mode | Shrinks the window to its compact layout, or restores the full one. |
| 5 | Close to tray | When on, closing the window hides it to the tray instead of quitting. This is the setting that makes the tray menu the whole interface. |
Danger, 5 rows
Every row here is destructive and every one ends in an ellipsis, which is the menu telling you a confirmation follows. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.
| # | Control | What it does |
|---|---|---|
| 1 | Panic Soft... | Cuts every network connection, clears the clipboard and locks the screen. A confirmation opens in the window first. Restarting the network does not undo it: the way back is Unblock Internet, which restores an allow-all firewall rather than the rules you had before, because none are backed up. No sign-in needed. runs health-control panic-soft |
| 2 | Wipe Browser Data... | Asks first, then closes Firefox and wipes its profile data: cache, cookies, saved sessions, download history and form history, followed by a bleachbit pass over Firefox and Chromium. It cannot be undone. Needs sign-in. runs health-control wipe-browser-data |
| 3 | Clean Memory... | Asks first, then flushes pending writes to disk and drops the kernel's file caches, so memory that held old data is freed. Programs may pause briefly while they re-read from disk. Needs sign-in. runs health-control memory-clean |
| 4 | Wipe Logs... | Asks first, then deletes the system and application logs: everything under /var/log including the Tor logs, the login records and the authentication log. Anything you have not read yet is gone. Needs sign-in. runs health-control wipe-logs |
| 6 | Shutdown System... | Shuts the machine down after a confirmation in the window. Every row in this group ends in an ellipsis for that reason. No sign-in needed. runs killswitch_shutdown (sudo systemctl poweroff, then sudo shutdown -h now) |
The tick boxes are readings, not switches you set. A tick next to VPN, Tor or a protocol means a probe found it on. Clicking one asks for the change; the tick moves when the machine answers, not when you click.
An ellipsis means a confirmation follows. Every row in the Danger group ends in one, so do the identity rows that force a change, and so does Restore Default DNS in the Network group. Nine rows confirm in all; none of them acts on the click alone.
Nine of these rows finish in the window. They open a confirmation there rather than acting from the menu, so the tray will bring the window forward for those even though it hid it a moment ago.