Linux

mins for Linux is built for x86-64 (amd64) as .deb, .rpm, Arch pkg.tar.zst and a tar.gz. The packages depend on GTK 3, libsecret and nftables.

How the parts fit together

Part	Where	What it does
The app	/usr/lib/mins/mins, linked as /usr/bin/mins	The window, the tray icon, your data
The engine	/usr/lib/mins/mins-engine	Carries the traffic
The privileged helper	/usr/lib/mins/mins-helper, runs as root	Creates the TUN interface and routes, arms the kill switch. Listens on /run/mins-helper.sock
The group mins	system group	Only root and members of this group may talk to the helper

The three connection modes need different things:

Mode	Needs
Proxy only	Nothing. No helper and no group. You point applications at the local proxy
System proxy	A supported desktop (see below). No helper, no group
VPN (TUN)	The helper running, and your user in the group mins

Installing

The .deb, .rpm and Arch packages run an install script that creates the group mins, creates /var/lib/mins, and enables and starts mins-helper on the init system that is running: systemd, OpenRC, dinit, runit or s6. It does not add you to the group, by design. It prints:

mins: TUN access grants root-equivalent routing control. An administrator must explicitly run: usermod -aG mins USER; then log out and back in. Proxy-only/system-proxy need no group membership.

If the install happens where no init system is running (a container, chroot, image build), the script says so and gives the manual command: /usr/lib/mins/mins-helper run as root.

The tar.gz does not run any scripts. It contains the same file layout as the packages, plus the scripts in /usr/lib/mins/scripts/. Install it like this:

1. Extract it as root into /. Use --no-overwrite-dir so that the archive’s top-level folder does not change the permissions of /: sudo tar -xzf mins-<version>-linux-x86_64.tar.gz -C / --no-overwrite-dir
2. Install the dependencies (GTK 3, libsecret, nftables) with your package manager.
3. Run the post-install script as root: sudo sh /usr/lib/mins/scripts/postinstall. It creates the group and the state folder and enables the helper.
4. Add yourself to the group (next section).

To remove a tarball install by hand, run sudo sh /usr/lib/mins/scripts/preremove first. It stops the helper and lifts the kill switch.

Using VPN (TUN)

TUN helper unavailable: <reason>; install/enable mins-helper and join group mins

The reason at the end of the first part tells you which of the two causes it is:

Reason	Cause	Fix
No such file or directory (os error 2) or Connection refused (os error 111)	The helper is not running	Check and start it (below)
Permission denied (os error 13)	Your session is not in the group mins	Add yourself to the group, then log out and in

Check the helper (systemd shown; other init systems have the same service named mins-helper):

systemctl status mins-helper
journalctl -u mins-helper -b

If it is not active, sudo systemctl enable --now mins-helper. Without an init system run sudo /usr/lib/mins/mins-helper run in a spare terminal.

Join the group

sudo usermod -aG mins "$USER"   # or your distribution's equivalent

Then log out and back in (or reboot). A running session keeps its old group list. Check with id -nG: it must list mins.

Caution

Membership in mins is root-equivalent control over your routing, like wireshark or docker. Add only accounts you trust.

Other helper refusals appear in the helper log:

• uid N is not in group `mins` : the same as above for another account.
• group `mins` does not exist: the install script did not finish; run it again (sudo sh /usr/lib/mins/scripts/postinstall).
• executable … is not under /usr/lib/mins: the helper only serves the installed app. If you start a copy of mins from your home folder or /opt, TUN is refused. Start /usr/bin/mins.
• mins-helper must run as root: the helper was started as a normal user.

System proxy

System proxy is supported on GNOME, Cinnamon, Unity (through gsettings) and KDE Plasma 6 (through kreadconfig6, kwriteconfig6 and dbus-send). The desktop is recognised from XDG_CURRENT_DESKTOP. Anywhere else, including MATE, you get:

System proxy is unavailable on this desktop; select proxy_only

Use Proxy only instead and point your applications at 127.0.0.1, port Mixed proxy port (default 10808, Settings → Advanced); it accepts both HTTP and SOCKS5. If a tool it needs is missing, you get a message like /usr/bin/gsettings: No such file or directory (os error 2).

Your previous desktop proxy settings are saved and restored on disconnect. If a restore fails you get Cannot recover original proxy settings from <file>: … Backup preserved; restore the original settings manually before reconnecting. Set the proxy back to “none” in your desktop’s network settings, then press Disconnect and connect again. another mins host is active or still restoring the original proxy settings means a second mins is running; quit it.

Kill switch

Settings → Connection → Kill switch needs nftables (nft) and VPN (TUN). Without nftables you get arming the kill switch failed (is nftables installed?). With a proxy mode you get kill switch requires TUN.

The helper keeps its firewall table (inet mins_killswitch) when the engine crashes and when the helper restarts or the package is upgraded, so the machine stays sealed instead of leaking. It is lifted by:

1. Disconnect in mins;
2. sudo /usr/lib/mins/mins-helper killswitch-clear;
3. removing the package.

If something else flushes the firewall (an nftables or firewalld reload), the helper puts its table back within a second.

Storage and libsecret

mins keeps the key that encrypts your servers in the Secret Service of your user session (libsecret). A provider such as GNOME Keyring, KWallet or KeePassXC must be running and unlocked in your session D-Bus. Otherwise mins stops at startup (mins could not start), or reports lost data (Cannot decrypt profile) when the keyring is a new empty one. Start mins from your normal desktop session, not from su, sudo or a plain SSH shell.

Tray icon and autostart

• Closing the window hides mins; it stays running. Quit with Quit from the tray icon menu. Without a tray (general advice: GNOME needs an AppIndicator extension) you cannot bring a hidden window back: start mins again.
• Settings → Connection → Launch at login writes ~/.config/autostart/mins.desktop. Connect at login connects when the app starts.
• The package registers the mins:// link handler through its .desktop file.

Upgrades and removal

An upgrade restarts the helper and keeps the kill switch armed if it was. Removing the package disables the service and lifts the kill switch, so the machine is not left firewalled by software that is gone.