t
A private overlay network in Rust. A machine’s identity is its public key, not its address. Members talk end to end encrypted over whatever path works, and relays forward only ciphertext.
The problem
Machines at home, in the office and in the cloud sit behind NATs and firewalls. Hosted mesh VPNs work, but they keep the keys to your network on someone else’s coordination server.
How it works
- Membership is issued by an offline root. A node generates its own keys, and the root signs a request it can read in full, so neither blob carries a secret and both can travel over any channel.
- The root signs the network state: relays, revoked certificates, policy grants and published services. Nodes keep working from it while the root is offline, and policy denies by default.
- Two nodes behind separate NATs dial each other at the same moment on a signal sent through a relay. A connection falls back to a shared relay after a quarter of a second while the direct dial carries on.
- On a hostile path a relay accepts links inside TLS on port 443 and hands any connection that does not prove membership to an ordinary website.
- Members can hold an exit to the internet, open a time-limited session into a machine that is not a member, or serve a public HTTPS site through relays that pass the TLS connection on untouched.
- The daemon needs no privileges and writes a local JSON audit trail. t doctor checks certificates, state and relays, and every command has a --json form to script against.
Built with
- Rust
- TLS
- NAT traversal
- SOCKS5
- systemd
- launchd