diff --git a/conf/dnsresolver_other.go b/conf/dnsresolver_other.go
new file mode 100644
index 0000000..ea1b0c1
--- /dev/null
+++ b/conf/dnsresolver_other.go
@@ -0,0 +1,35 @@
+// +build !windows
+
+/* SPDX-License-Identifier: MIT
+ *
+ * Copyright (C) 2019 WireGuard LLC. All Rights Reserved.
+ */
+
+package conf
+
+import (
+	"fmt"
+	"net"
+)
+
+func resolveHostname(name string) (resolvedIPString string, err error) {
+	ips, err := net.LookupIP(name)
+	if err != nil {
+		return "", err
+	}
+	var ip net.IP
+	for _, iterip := range ips {
+		if ip4 := iterip.To4(); ip4 != nil {
+			ip = ip4
+			break
+		}
+		if ip == nil {
+			ip = iterip
+		}
+	}
+	if ip == nil {
+		return "", fmt.Errorf("unable to resolve IP address of endpoint %q (%v)", name, ips)
+	}
+
+	return ip.String(), nil
+}
diff --git a/conf/path.go b/conf/path.go
new file mode 100644
index 0000000..89e7a96
--- /dev/null
+++ b/conf/path.go
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: MIT
+ *
+ * Copyright (C) 2019 WireGuard LLC. All Rights Reserved.
+ */
+
+package conf
+
+var cachedConfigFileDir string
+var cachedRootDir string
+var disableAutoMigration bool
+
+// PresetRootDirectory causes RootDirectory() to not try any automatic deduction, and instead
+// uses what's passed to it. This isn't used by wireguard-windows, but is useful for external
+// consumers of our libraries who might want to do strange things.
+func PresetRootDirectory(root string) {
+	cachedRootDir = root
+	disableAutoMigration = true
+}
diff --git a/conf/path_other.go b/conf/path_other.go
new file mode 100644
index 0000000..3363fff
--- /dev/null
+++ b/conf/path_other.go
@@ -0,0 +1,39 @@
+// +build !windows
+
+/* SPDX-License-Identifier: MIT
+ *
+ * Copyright (C) 2019 WireGuard LLC. All Rights Reserved.
+ */
+
+package conf
+
+import (
+	"os"
+	"path/filepath"
+)
+
+func tunnelConfigurationsDirectory() (string, error) {
+	if cachedConfigFileDir != "" {
+		return cachedConfigFileDir, nil
+	}
+	root, err := RootDirectory()
+	if err != nil {
+		return "", err
+	}
+	// on linux the configs are just in /etc/wireguard
+	cachedConfigFileDir = root
+	return cachedConfigFileDir, nil
+}
+
+func RootDirectory() (string, error) {
+	if cachedRootDir != "" {
+		return cachedRootDir, nil
+	}
+	c := filepath.Join("/etc", "wireguard")
+	err := os.MkdirAll(c, os.ModeDir|0700)
+	if err != nil {
+		return "", err
+	}
+	cachedRootDir = c
+	return cachedRootDir, nil
+}
diff --git a/conf/store.go b/conf/store.go
index f6f450c..31d6668 100644
--- a/conf/store.go
+++ b/conf/store.go
@@ -10,8 +10,6 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
-
-	"golang.zx2c4.com/wireguard/windows/conf/dpapi"
 )
 
 const configFileSuffix = ".conf.dpapi"
@@ -71,7 +69,7 @@ func LoadFromPath(path string) (*Config, error) {
 		return nil, err
 	}
 	if strings.HasSuffix(path, configFileSuffix) {
-		bytes, err = dpapi.Decrypt(bytes, name)
+		bytes, err = platformUnenvelope(bytes, name)
 		if err != nil {
 			return nil, err
 		}
@@ -110,7 +108,7 @@ func (config *Config) Save(overwrite bool) error {
 	}
 	filename := filepath.Join(configFileDir, config.Name+configFileSuffix)
 	bytes := []byte(config.ToWgQuick())
-	bytes, err = dpapi.Encrypt(bytes, config.Name)
+	bytes, err = platformEnvelope(bytes, config.Name)
 	if err != nil {
 		return err
 	}
diff --git a/conf/store_other.go b/conf/store_other.go
new file mode 100644
index 0000000..cfc02a9
--- /dev/null
+++ b/conf/store_other.go
@@ -0,0 +1,16 @@
+// +build !windows
+
+/* SPDX-License-Identifier: MIT
+ *
+ * Copyright (C) 2019 WireGuard LLC. All Rights Reserved.
+ */
+
+package conf
+
+func platformEnvelope(bytes []byte, name string) ([]byte, error) {
+	return bytes, nil
+}
+
+func platformUnenvelope(bytes []byte, name string) ([]byte, error) {
+	return bytes, nil
+}
diff --git a/conf/store_windows.go b/conf/store_windows.go
new file mode 100644
index 0000000..ab66402
--- /dev/null
+++ b/conf/store_windows.go
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: MIT
+ *
+ * Copyright (C) 2019 WireGuard LLC. All Rights Reserved.
+ */
+
+package conf
+
+import (
+	"golang.zx2c4.com/wireguard/windows/conf/dpapi"
+)
+
+func platformEnvelope(bytes []byte, name string) ([]byte, error) {
+	return dpapi.Encrypt(bytes, name)
+}
+
+func platformUnenvelope(bytes []byte, name string) ([]byte, error) {
+	return dpapi.Decrypt(bytes, name)
+}