Everything the platform does
Six chapters, each covering one part of the system in the detail an operator actually needs. Start anywhere — they are written to be read on their own.
Security model
How an account is proved, how a device is bound to a person, what a connect ticket is, and why every refusal answers the same way.
Chapter oneNodes & network
Enrollment with a one-time key, a private CA, mutual TLS, heartbeat and lease reconciliation, and both data planes.
Chapter twoClient apps
Windows, Android and iOS. Split privilege, leak prevention, the kill switch, and generated wire models that cannot drift.
Chapter threeAdministration
The console: accounts, activation, per-user limits, node approval, live sessions, enrollment keys and the audit trail.
Chapter fourUsage & quotas
Counting bytes without double counting them, and enforcing a quota within a lease interval rather than at a nightly batch.
Chapter fivePrivacy & retention
The exact list of what is stored, for how long, and the parts of a conventional VPN that are deliberately absent here.
Chapter sixThe whole feature list
If you are comparing platforms, this is the table to skim. Each line links into the chapter that explains it.
Accounts and access
- Self-service registration, inert until an administrator activates it
- Administrator-created accounts, active from the start
- Argon2id password hashing with per-user salt and stored parameters
- Optional TOTP second factor, enrolled per account by its holder
- Per-account lockout with exponential backoff, plus per-address rate limits
- Suspend, reinstate and disable, each with a defined effect on live sessions
Devices and sessions
- Ed25519 device keys generated on the machine and never transmitted
- Challenge–response on every sign-in, not a self-asserted fingerprint
- Per-user device limit, with self-service revocation and a cooldown
- Per-user concurrent-session limit, enforced inside one transaction
- Displace-oldest or reject, chosen per account
- Fresh WireGuard keypair per connection, discarded on disconnect
Nodes
- One-time enrollment keys with use counts, expiry and revocation
- Certificates issued by the master's own CA, never a public one
- Mutual TLS on every node-to-master call, identity from the certificate
- Pending approval, active, draining and disabled, plus derived offline
- Automatic tunnel-subnet allocation from a global pool
- Linux and Windows Server data planes behind one interface
Operations
- Hourly usage per user, per node and per session
- Weekly or monthly quotas that enforce on the ingest path
- Optional per-user rate limiting
- Live session list with force disconnect
- Append-only audit log with actor, target, before and after
- Retention windows for sessions, usage, tickets, audit and client IPs
See it running
Register on this master and an administrator will activate you, or read the deployment guide and stand up your own.