The Fabric
Your own devices, one private network, no account required.
A small always-on daemon binds one endpoint per profile and gives all your machines a single cryptographic identity. Devices find each other over mDNS on a LAN, dial each other directly across the internet, and fall back to a relay you host yourself when direct is impossible. Every session reports which path is carrying its bytes.
- 10Working today
- 1Being built
- 2Planned
The mechanism, not the metaphor.
- 01 One identity
The daemon binds one endpoint per profile under a single device id.
- 02 Pair once
Each side pastes the other's ticket or permit. No login and no server involved.
- 03 Find the peer
mDNS on the LAN, a remembered address, or the relay map.
- 04 Choose a path
The transport settles on direct or relay, and the session reports which one.
- 05 Three gates open
Admission, principal authorization, then a per-channel grant.
- 06 Notice and recover
A silent peer ends its channels inside the frozen bound. Reconnecting is the caller's move.
13 capabilities, and where each one stands.
Identity and pairing
- Working today Device identity
An identity that survives restarts, and survives rotating the key under it.
- Working today One-paste pairing
Two devices trust each other from one pasted string. No server, no login.
- Working today Three gates per channel
Admission, then principal authorization, then a grant for that one channel.
Getting the bytes there
- Working today mDNS discovery
Devices find each other by name with no key, no address and no public lookup.
- Working today Direct peer-to-peer
QUIC, with multipath and NAT traversal left in place rather than tuned away.
- Working today Self-hosted relay fallback
Two genuinely isolated sites still complete a session through your own relay.
- Working today Stable fabric port
A remembered address stays true across a peer restart.
Seeing what is happening
- Working today Visible path selection
Ask any session whether it is direct or relayed, and get a straight answer.
- Being built Relayed, shown on screen
A person can see a transfer is relayed without opening a terminal.
- Working today Bounded unreachability
A silent peer ends its channels inside a number this project owns.
- Working today Device health snapshot
Read cpu, memory, storage, load and heaviest processes on a peer.
- Planned Link Test
Explicit, cancellable, bounded RTT and throughput on the real path.
- Planned Fleet health dashboard
One screen for every device's cpu, disk, battery and version.
Numbers from tests that ran.
- 45 s
The unreachability bound — a number this project pinned rather than inherited. A killed peer's channels ended at 34.7 s in containers.
- Two isolated networks
Relay fallback proven between genuinely separated Docker networks — and watched to fail when the isolation was removed.
- Relay → direct
A live session follows its own path across the migration and keeps reporting the truth.
- No relay, no key
What mDNS discovery needs on a LAN. Verified across two containers with no public lookup available.
And what it is not
- Not a VPN or a virtual-IP mesh. Service-level connectivity comes first; a full mesh is deferred on purpose.
- Not background reachability polling. A link test is a user action on an already-authorized path, never a hidden ping.
- Not a network ACL. A path answers how to reach a device, never whether that peer may call an operation.
- Not a managed-WAN underlay. There is no integration with one, and no evidence pretending otherwise.
Start with the devices you already own.
Make them work
as one.
The open core is ready to explore. Build your personal device fabric with Xross.
Open-source core · Direct by design · Your devices, your fabric