Component 01
Rizoma Mesh is the private network core.
Enroll nodes, assign mesh IPs and Rizoma.mesh names, build encrypted QUIC paths through TUN, distribute ACL policy, and keep networks reachable through relays and ingress. Every Rizoma product depends on this layer.
Core control loop
agent enrolls through /v1/enroll and receives mesh IP, token, certificates
heartbeat publishes endpoints, E2E key, telemetry, and command results
coordinator returns peers, relay selection, ACL sync, and ingress assignments
TUN captures 100.64.0.0/10 packets and routes them to peer public keys
relay and ingress preserve reachability when direct paths are not enough
A real network fabric, not a VPN landing page.
Architecture
A real network fabric, not a VPN landing page.
The implementation is split into binaries with clear jobs: agents move packets, the coordinator owns identity and policy, relays preserve reachability, ingress publishes selected services, and the dashboard makes the mesh operable.
Agent
Runs on each node, opens the TUN interface, applies routes, advertises endpoints, handles heartbeat, and moves encrypted packets over QUIC.
Coordinator
Owns enrollment, MeshCA, peer records, setup keys, RBAC, ACL distribution, relay inventory, monitoring, snapshots, and system APIs.
Policy & Transport
Compiles ACLs, teams, groups, firewall rules, and uses QUIC streams with hybrid X25519 + ML-KEM-768 session setup.
Data plane
Packets enter the mesh as ordinary IP traffic.
Applications target mesh IPs or Magic DNS names. The agent captures traffic through TUN, resolves destination peers, encrypts packets, and sends them over the best available QUIC path.
TUN
Transparent IP capture
Each node gets a TUN interface, a /32 mesh address, and routes for the 100.64.0.0/10 fabric.
DNS
Magic DNS
Peer names normalize into stable Rizoma.mesh hostnames so operators do not manage manual DNS records.
QUIC
Modern transport
Peer traffic uses QUIC for multiplexing, TLS transport, streams/datagrams, and firewall-friendly UDP reachability.
E2E
Payload protection
Hybrid session setup combines X25519 and ML-KEM-768, protecting payloads with AES-GCM and replay checks.
relay
Reachability fallback
Relays preserve connectivity when direct peer paths are unavailable, keeping forwarded payloads encrypted.
exit
Exit-node routing
Linux routing redirects traffic through a selected mesh gateway with route exclusions, NAT, MSS clamping, and leak controls.
Security model
Identity, encryption, and policy as part of the network path.
Mesh does not rely on a flat trusted subnet. Nodes enroll, receive certificates and tokens, publish heartbeat state, sync ACLs, and have packet flow constrained by identity-aware policy.
MeshCA
The coordinator issues and renews mesh certificates, stores CA material with key protection, and exposes certificate operations through guarded APIs.
Hybrid crypto
Session setup binds QUIC keying material to X25519 + ML-KEM-768 exchange, confirmation tags, AES-GCM, and replay windows.
Authorization & firewall
RBAC, setup keys, node tokens, and method-level permissions protect the control plane. Agents report observations for incident tracking and quarantine.
Packet journey
From app to peer.
Every packet follows the same path: capture, resolve, encrypt, transport, inject.
Capture
Application traffic addressed to 100.64.0.0/10 enters the local TUN interface.
Resolve
The agent maps destination mesh IP or Magic DNS name to peer identity, endpoint, and allowed policy.
Encrypt
Payloads are wrapped with the active E2E session before leaving the node.
Transport
QUIC sends directly when possible, or through relay fallback when NAT requires it.
Inject
The receiving agent validates source identity, decrypts, checks replay state, and injects into its TUN device.
Operations
Operators can see and control the fabric.
Mesh includes dashboard, APIs, metrics, telemetry, snapshots, and package workflows so the private network can be run as production infrastructure.
UI
Dashboard
The dashboard proxies /v1 APIs, serves peer and relay installers, and gives operators a management surface.
/v1
Coordinator API
Endpoints cover auth, nodes, peers, ACLs, relays, ingress, MeshCA, firewall, telemetry, snapshots, and monitoring.
metrics
Observability
Agent, coordinator, relay, ingress, and dashboard expose health, readiness, info, and Prometheus metrics.
pkg
Packaging
APT/DNF/YUM oriented packaging, systemd units, installers, relay registration, and update status.
Use cases
Where the core mesh earns its place.
Mesh is the foundation for secure access, private service networks, and the rest of the Rizoma product stack.
VPN replacement
Private access without a flat perimeter
Replace broad VPN access with node identity, mesh IPs, Magic DNS, explicit ACLs, and per-peer encrypted paths.
Sites and clouds
Join servers, offices, and clouds
Connect Linux hosts, internal services, remote offices, and cloud nodes through one controlled fabric.
Private products
Base layer for Rizoma products
Webpanel, object storage, and internal applications rely on mesh reachability instead of public exposure.
Technical facts
Concrete product details.
Binaries
agent, coordinator, relay, ingress, dashboard, plus certificate and hash helper commands.
API
Coordinator REST API under /v1 for enrollment, heartbeat, nodes, peers, ACLs, relays, ingress, auth, MeshCA, telemetry, snapshots, firewall, WAF, and monitoring.
Networking
TUN device, QUIC peer transport, relay fallback, ingress routing, exit-node routing, route exclusions, and optional AF_XDP/XDP paths.
Addressing
Authoritative mesh range 100.64.0.0/10, per-node /32 assignment, default MTU 1420, Magic DNS suffix Rizoma.mesh.
Crypto
MeshCA certificates, X25519 + ML-KEM-768 hybrid session setup, AES-GCM payload protection, QUIC binding, and replay detection.
Storage
SQLite or PostgreSQL for coordinator state, node records, ACLs, relays, ingress resources, events, snapshots, and operational settings.
Deploy the core
Build the private fabric before exposing services.
Start with Mesh when you need node identity, encrypted reachability, policy, relay fallback, ingress, and operational evidence in one core layer.