Linux / Wayland · Software KVM

One
keyboard.
Every machine.

deskway is a software KVM for Wayland. Push your cursor off the screen edge — control switches to the next machine. QUIC transport. TLS 1.3 encryption. No X11. No portal. Real compositor protocols.

zwp_virtual_keyboard_v1 · zwlr_virtual_pointer_v1 · quinn + rustls · Hyprland / sway

← portfolio

DWKVM-SYS-001

System Architecture

Machine A · Server

owns physical hardware · flowd host

flowd

input capture daemon

Reads raw keyboard and pointer events from /dev/input/ via evdev. Serves them over QUIC on port 7878. Triggers switch when pointer hits the configured screen edge.

evdev · quinn · UDP 7878

Switch trigger

cursor → right edge

configurable: right / left / top / bottom

QUIC · TLS 1.3

UDP · port 7878
postcard wire format

flowctl

control plane

Machine B · Client

receives events · flowc host

flowc

input injection daemon

Injects received events into the Wayland compositor via zwp_virtual_keyboard_v1 and zwlr_virtual_pointer_v1. Works on any wlroots compositor.

wayland-client · wlroots

Emergency hotkey

Super+Ctrl+BackSpace

instantly reclaims server control

DWKVM-DAE-002

Daemon Specifications

flowd

flow daemon · server process

cratecrates/flowd

transportQUIC (quinn)

cryptoTLS 1.3 (rustls)

inputevdev /dev/input

bind0.0.0.0:7878 UDP

triggerscreen edge

user groupinput

systemdflowd.service

flowc

flow client · target process

cratecrates/flowc

transportQUIC (quinn)

keyboardzwp_virtual_keyboard_v1

pointerzwlr_virtual_pointer_v1

compositorHyprland · sway · niri

xwayland fbydotool (optional)

clipboardwl-clipboard sync

systemdflowc.service

flowctl

control CLI · both machines

cratecrates/flowctl

statusflowctl status

pairflowctl pair

trust listflowctl trust list

revokeflowctl untrust <fp>

wirepostcard over QUIC

config~/.config/deskway/

scopeeither machine

DWKVM-SEC-003

Security Model

First Contact — HMAC PSK

flowd prints a 6-digit PSK on startup. Pass it as an env var when launching flowc. Valid for 60 seconds. HMAC-SHA256 authenticated.

DESKWAY_PSK=482159 ./flowc

✓

Channel — TLS 1.3

QUIC establishes a full TLS 1.3 channel. Certificate generated by rcgen. All traffic is encrypted end to end before a single input event is forwarded.

rustls · rcgen · TLS 1.3 only

✓

TOFU Fingerprint Pinning

After first handshake, the certificate fingerprint is pinned. PSK no longer required. An unknown peer — even from the correct IP — cannot inject input.

~/.config/deskway/trusted_peers

✓

Active Session

All events encrypted in flight. Super+Ctrl+BackSpace emergency reclaim enforced at the protocol level — flowd stops forwarding immediately, regardless of what the client displays.

Super+Ctrl+BackSpace → instant

DWKVM-FEAT-004

Feature Matrix

Feature	Description	Implementation	Status
Edge trigger	Push cursor to configured screen edge; control switches	server.edge = "right"	● live
TOFU pinning	Certificate fingerprint pinned after first PSK auth	rcgen + rustls	● live
Clipboard sync	Bidirectional text clipboard via wl-clipboard	clipboard.enabled	● live
Emergency key	Super+Ctrl+BackSpace instantly reclaims server input	protocol-level	● live
systemd units	User service files; PKGBUILD installs and enables	systemd/	● live
Arch PKGBUILD	Installs daemons, service files, group setup	PKGBUILD	● live
Multi-monitor	Multiple monitors per machine, per-output edge config	—	○ planned
Audio routing	PipeWire audio follows the active pointer machine	—	○ planned

One keyboard. Every machine.

System Architecture

Daemon Specifications

Security Model

Feature Matrix

One
keyboard.
Every machine.