Together, wherever they are.
A private connection between your devices, with a direct path when possible and a relay when needed.
Full capability details ↓Choose a view
Pick a peer. Watch the path change.
Six trusted devices share one fabric. Select a peer, then compare a direct connection with the same request carried through your relay.
DEVICES
Interactive local sample · Route controls change this illustration only.
How it works
One identity
The daemon binds one endpoint per profile under a single device id.
Pair once
Each side pastes the other's ticket or permit. No login and no server involved.
Find the peer
mDNS on the LAN, a remembered address, or the relay map.
Choose a path
The transport settles on direct or relay, and the session reports which one.
Three gates open
Admission, principal authorization, then a per-channel grant.
Notice and recover
A silent peer ends its channels inside the frozen bound. Reconnecting is the caller's move.
A small always-on daemon binds one endpoint per profile and gives all your machines a single cryptographic identity. Devices find each other over mDNS on a LAN, dial each other directly across the internet, and fall back to a relay you host yourself when direct is impossible. Every session reports which path is carrying its bytes.
What this feature is not
- Not a VPN or a virtual-IP mesh. Service-level connectivity comes first; a full mesh is deferred on purpose.
- Not background reachability polling. A link test is a user action on an already-authorized path, never a hidden ping.
- Not a network ACL. A path answers how to reach a device, never whether that peer may call an operation.
- Not a managed-WAN underlay. There is no integration with one, and no evidence pretending otherwise.
13 capabilities, tracked in the project.
These are recorded implementation states, not public release availability. Platform and direction support vary; public releases remain unverified.
Identity and pairing
- Working today Device identity
An identity that survives restarts, and survives rotating the key under it.
- Working today One-paste pairing
Two devices trust each other from one pasted string. No server, no login.
- Working today Three gates per channel
Admission, then principal authorization, then a grant for that one channel.
Getting the bytes there
- Working today mDNS discovery
Devices find each other by name with no key, no address and no public lookup.
- Working today Direct peer-to-peer
QUIC, with multipath and NAT traversal left in place rather than tuned away.
- Working today Self-hosted relay fallback
Two genuinely isolated sites still complete a session through your own relay.
- Working today Stable fabric port
A remembered address stays true across a peer restart.
Seeing what is happening
- Working today Visible path selection
Ask any session whether it is direct or relayed, and get a straight answer.
- Being built Relayed, shown on screen
A person can see a transfer is relayed without opening a terminal.
- Working today Bounded unreachability
A silent peer ends its channels inside a number this project owns.
- Working today Device health snapshot
Read cpu, memory, storage, load and heaviest processes on a peer.
- Planned Link Test
Explicit, cancellable, bounded RTT and throughput on the real path.
- Planned Fleet health dashboard
One screen for every device's cpu, disk, battery and version.
Start with the devices
you already own.
Make a little more room for what you do.
Find your way in.
Public downloads are being confirmed. Explore the workflows and development status to see what's taking shape.
Explore features