All work
Blanarch · Personal product · 2026
Android VPN client, built from the protocol up
Blanarch is my own Android app for connecting to FortiGate SSL-VPN gateways running FortiOS 7.6.2 or older (7.6.3 removed tunnel mode). I designed the architecture and wrote the protocol spec and the tests; Claude Code agents implemented against them, and I reviewed the result. It connects end to end on a real gateway, through network loss and session expiry. Not affiliated with Fortinet.
Architecture
- A Flutter UI on the MVVM pattern from the official Flutter architecture guide, with one place where dependencies are wired and Result and Command types instead of thrown errors.
- A typed Pigeon contract between Dart and Kotlin: commands go down, status events come up, and both sides are generated from one file.
- Ports and adapters in the Kotlin engine. Protocol logic is pure and free of I/O, so sign-in, framing and PPP are tested without a network.
Connection engine
- A coroutine orchestrator that fails over between a profile’s gateways and rejoins with the same session when it can.
- Offline, it waits without using up retry attempts, and it rejoins as soon as the real network changes.
- A foreground VPN service with a Quick Settings tile, notifications with Reconnect, Disconnect and inline code reply, always-on VPN and split routing.
Security and sign-in
- Never trusts a certificate silently: the user confirms its SHA-256 fingerprint, which is then pinned per host.
- Passwords are encrypted with AES-GCM under an Android Keystore key, behind a biometric or screen-lock app lock.
- Sign-in by password and code, push approval, or SAML single sign-on through a loopback listener that works in any browser. It can also read emailed one-time codes over IMAP.
- Setup links and QR codes let IT share a connection, and they never carry passwords.