How it works
A private mesh, one front door, a cloud that heals itself.
No magic — just a handful of proven ideas wired together carefully. Here's the whole thing, without the jargon.
The shape of it
Everything lives behind one entrance.
Visitors only ever reach a single front door. It handles encryption, decides which app you're asking for, checks you're allowed in, and passes you to a healthy copy — while your data stays tucked safely inside a private network.
Two private networks
The servers talk on roads no one else can see.
Watchtower runs two separate private networks, each for a different job. Neither is reachable from the open internet.
The cluster mesh
A fast, always-on, post-quantum-encrypted link between the main servers. The database, the coordination, the internal chatter — all of it rides here, invisible to the outside world.
WireGuard + Rosenpass
The peer overlay
A second private network that reaches machines that roam — a PC at home, a box behind someone's router. Heavy apps (media, AI, big files) run there and are still served through the same front door.
NetBird
How it stays up
Designed to lose a server and shrug.
The important parts run in more than one place. The front door constantly checks each server's pulse and only ever routes you to a healthy one — so a crash becomes a non-event instead of an outage.
- Copied — your database and files are mirrored across servers, so no single machine holds the only copy.
- Restarted — the apps themselves are stateless and just start again elsewhere in seconds.
- Rebuilt — a lost server is re-created from the blueprint and rejoins, no hand-tuning.
All three nodes are serving traffic.
How you run it
The whole system is one blueprint.
Because it's all written down as code, the cloud you build is reproducible — rebuild it, move it, or hand it to a friend, and it comes out identical.
Bring your hardware
A few small servers and a domain name. Rented VPSes, mini-PCs at home, or a mix.
Run one command
The blueprint provisions the mesh, the cluster, the database, the front door, sign-in, and every app — in the right order, automatically.
It runs itself
Health checks and self-restart run on their own; backups are taken on a schedule, and updates arrive as automatic pull requests you review and apply. You watch dashboards when you're curious, not because something's on fire.
Invite others OPTIONAL
Others can run their own front on their own domain, served by the same cluster and login — sharing the resilience. Full per-tenant isolation (separate data and identity) is on the roadmap.
Curious how deep it goes?
Own your cloud.
Every layer here is on GitLab — the mesh, the database failover, the ingress, the reasoning behind each choice.