DVeMesh 0.1.1-alpha

Secure overlay networking you host yourself.

DVeMesh is the Control Plane for DVeProto mesh networks. It manages membership, enrollment, and configuration. Devices keep their private keys. User traffic never transits this website.

Create an account Read the docs

What is DVeMesh

A membership layer, not a packet path.

Accounts, networks, devices, enrollment tokens, and config sync. DVeMesh does not decrypt or route overlay packets. The data plane is DVeProto on each device.

How it works

Network, enroll, sync.

1. Create a network

An isolated CIDR and DVeIP pool. Default prefix is 10.77.0.0/16.

2. Enroll devices

Control issues a one-time token. The agent proves possession of its NodeIdentity.

3. Sync configuration

Agents pull peers, ACL, and endpoints. Heartbeats update presence. Existing sessions survive Control downtime.

Why DVeMesh

Control on your infrastructure.

Self-hosted

Run the Control Plane on your Linux host. MySQL/MariaDB. No vendor overlay required.

DVeProto

Ed25519 NodeID, Handshake 2.0, AEAD frames. DVeMesh does not replace that crypto stack.

Security boundary

Private keys never leave the device. Control can lie about membership; it cannot decrypt traffic.

Implemented now

Linux data plane

TUN dve0, scoped routes, DVeProto UDP sessions, NAT hole punch coordination.

Overlay membership

Networks, devices, DVeIP allocation, default-deny ACL distribution.

Coming later

Windows, macOS, and Android dataplane are not shipped. Relay is not implemented.