Why NetForge

Local-firstCore apply path works offline. Logs stay on your machine.
IdempotentSafe to re-run on logon and network connect with lock files.
Config-drivenReview defaults and profiles before you elevate.

Feature matrix

Capability	Windows	macOS	Linux
Prefer Ethernet metrics / order	Yes	Yes	Yes
Encrypted DNS preference	DoH	Plain DNS API	DoT (resolved)
Captive portal helper	Yes	Yes	Yes
VPN respect mode	Yes	Yes	Yes
Dry-run / what-if	Yes	Yes	Yes
Status JSON + HTML	Yes	Yes	Yes
Optional hardening flags	Yes	Yes	Yes

Install (review first)

Windows (Admin PowerShell)

git clone https://github.com/Pitchfork-and-Torch/netforge-windows.git
cd netforge-windows
.\src\Get-NetForgeStatus.ps1
.\src\NetworkAuto.ps1 -DryRun
.\src\Install-NetworkAuto.ps1

macOS / Linux

git clone https://github.com/Pitchfork-and-Torch/netforge-macos.git   # or netforge-linux
cd netforge-macos
./src/netforge-status.sh
sudo ./src/network-auto.sh --dry-run
sudo ./src/install-network-auto.sh

Philosophy & non-goals

NetForge hardens your host’s network stack. It does not configure your router, fix ISP caps, or replace privacy routing tools.

No telemetry, accounts, or phone-home
No required internet for applying local settings
Aggressive options stay behind config flags

Composes with trench-coat (privacy routing) and ghost-continuum (defense plane).

FAQ

How does NetForge improve network performance?

It prefers Ethernet over Wi-Fi via interface metrics (or service order on macOS), applies well-known TCP stack settings, sets resilient public DNS with encrypted DNS where the OS supports it, and re-applies on logon and network connect so settings stick after sleep or network changes.

Is NetForge safe with VPNs?

Yes when RespectVpn / RESPECT_VPN is enabled (default in v2). NetForge skips common VPN and tunnel adapters so it does not fight split-tunnel or corporate VPN routing. Corporate profiles further reduce hardening side effects.

Does it collect data?

No. There is no telemetry, no account, and no cloud requirement for the core apply path. Logs and last-run files stay under local application data directories.

How do I handle captive portals?

Run the platform captive-portal helper to probe connectivity endpoints and temporarily relax DoH/DoT/static DNS so hotel or airport portals can load. After authentication, restore with the helper’s restore flag or re-run the main apply script. Optional auto-restore is available on Windows.

Can I preview changes first?

Yes. Use NetworkAuto.ps1 -DryRun on Windows or network-auto.sh --dry-run on macOS/Linux to print planned actions without applying them.