39. VPN

In plain words: Design rule 39: Private network (VPN)

Designed 4 min read 11 glossary terms 8 connected pages
The short version written for the Snayu team

Defines the Tether extension: a self-hosted WireGuard tunnel giving the operator a private road to the host. It provides reachability only, never permissions inside LychD.

Why read it: Read this before setting up remote access over a VPN or touching network routes.
  1. 1Being on the tunnel grants no role, badge or permission; the Security Desk still authorizes every request.
  2. 2A private tunnel is not anonymity; it is not a consumer VPN exit or Tor.
  3. 3A failed private route must never silently fall back to an open one.

Designed No VPN provider, enrollment or peer registry is built.

Words on this page, decoded click one for its card

The original text Underlined words open their plain-English card.

Context

A MagusYou, the Operator may need a private road to the host without making administrative surfaces public or mistaking membership of that road for authority inside the VesselEngine Room.

Decision

The Tether extension uses WireGuard for an operator-controlled, encrypted, self-hosted private road. This layer supplies reachability only. Tunnel membership grants no application role, SigilID Badge, capability, or permission to a named object or effect.

Private reachability is not anonymous browsing. A tunnel can conceal destination traffic from the access network while moving visibility and trust to its endpoint; traffic timing and volume, endpoint addresses, browser fingerprints, accounts, and provider-held request content remain separate disclosure surfaces. Tether does not currently define a consumer VPN exit, browser anonymity profile, or Tor transport. An accepted future outbound privacy profile must name the observer it protects against and prove DNS, IPv4/IPv6, direct-route and reconnect failure closure, browser-origin isolation, and egress custody. It must never silently bypass a failed private route. Remote model/CLI requests still disclose their transmitted content to the receiving provider, irrespective of the road carrying it; Security owns that disclosure decision.

The Tether may manifest a rootless service with only the network capability it needs and explicit UDP publication. Interface name, listen port, address space, DNS behaviour, routes, and peer limits are Rune-owned configuration, not hard-coded topology. Typed operations under a future host-owned run-operation verb may generate a keypair, admit, inspect, revoke, rotate, or export a short-lived client configuration or QR projection; it adds no root CLI verb.

If that service is projected through Quadlet, its future RuneService Config File may embed the code-level QuadletConfig value under quadlet. That does not rename Tether to a kind of Stone, make it ana AnimatorModel Runtime, or grant generic unit-text authority; Tether keeps ownership of its exact network fields and compilation policy.

The Tether service remains outside the shared application Pod. It receives no broad mounts, application secrets, database credentials, or host-mutation channel; granting CAP_NET_ADMIN inside that Pod is not an acceptable shortcut.

The optional Gateway Host uses Tether only when placement requires a private routed road. Remote may admit one exact peer and backend route from the off-site Veil to Core; it receives no default route or ambient home reachability. Home needs no Tether merely because Veil runs on a separate local machine: an exact directly routed private segment may supply reachability while firewall and service authorization retain their separate duties.

Reach deployment roads

The Reach deployment matrix selects Tether by exact profile, not a trust toggle. Home-only and standalone outbound VPS use no Tether. Only reach.edge-home.public@1 requires one named VPS peer and the smallest route to a Tether-only private Veil backend for typed event admission, delivery claim, settlement, and health. It receives no default route or path to the home PhylacteryMemory Vault, Reach core, AltarControl Panel, model/provider API, Podman socket, Reactor, or host administration. Tether custody contains tunnel keys only; the edge relay keeps its disjoint workload credential and revoking one class never repairs another.

Peer custody and exact routes

The CodexSettings Folder may retain stable peer identity, public key, allowed addresses/routes, endpoint and keepalive policy, enabled/revoked state, and creation/rotation metadata. Private and preshared keys are hydrated through the secret boundary and never rendered into ordinary documentation, logs, QR history, or public peer records.

Each route must be explicit. Host firewall policy determines which listeners the interface can reach, Veil may apply ingress policy, and WardSecurity Desk and VesselEngine Room still authenticate and authorize. Database administration, lifecycle mutation, Oculus, audio, model APIs, and A2AAgent-to-Agent Line stay closed until their own policy admits the peer. A tunnel address, interface, peer key, or forwarded metadata can contribute credential evidence but cannot mint magus:*, widen aan SigilID Badge, or create an administrator.

Lifecycle, failure, and recovery

Binding validates peer-address overlap, route conflict, key reference, port collision, and the generated service contribution before inscription. Revocation removes the peer from the active interface and persists revised intent. Rotation overlaps old and new credentials only with explicit operator authorization. Versioned public peer/routing intent prevents restore or reconciliation from reviving revoked or stale access; failure stays visible and privileged traffic never falls back to a public route.

Dynamic addressing needs an operator-supplied reachable endpoint, whether through DNS, fixed addressing, or a separately accepted rendezvous mechanism. Carrier NAT, blocked UDP, changing endpoints, roaming, endpoint metadata, and traffic analysis remain concerns. Relay and NAT traversal require separate trust decisions; recovery cannot introduce them invisibly.

Delivery and consequences

This CovenantDesign Rule (ADR) is Designed. No VPN provider, interface, enrollment, peer registry, key rotation, route policy, health, or revocation path ships; generated deployment remains IPv4-loopback-only, rejects UDP, and must not be tunnelled or port-forwarded. State of Work owns that boundary.

Independent revocation is Tether's practical return. Operating that private road requires security-sensitive peer and route management, backup, rotation, recovery, and an account of uncertain direct reachability.