One node, many ways out
One node, many ways out
There is a moment every mesh setup runs into: the interface you configured stops working, and
the node is simply gone. You edit a config, restart, tell people the new address. Reticulum
solves half of this — a destination is a hash, not an address — and then most setups undo it by
pinning a node to one interface.
Resilum Core is a Reticulum node in Rust that keeps several interfaces up at once, under a
single identity, and moves a link to whichever one can currently reach the peer.
Start it, and ask it where it is
The image already carries Tor, Yggdrasil and I2P, and the entrypoint writes every config file
on first start. So a node is:
cd deploy && docker compose up -d
From there it is worth asking the node what it sees, because that is the part a mesh usually
hides from you:
resilumd status # interfaces up, addresses announced, links held
resilumd status --map # the neighbourhood, placed by latency rather than geography
The map is not a metaphor. Peers exchange positions over established links and measure the
round trip, so “near” means responsive, not geographically close — a node three countries away
on a good path sits closer than the one behind a congested circuit.
And the mesh is usable as an internet exit right away:
curl -s -x socks5h://127.0.0.1:10808 https://check.torproject.org/api/ip
There is nothing else to edit. Identity and state persist in a mounted directory, so a restart
comes back as the same node.
The build is the same everywhere
The role follows from what the machine has, not from a different build. Images are published
for amd64 and arm64, so the same command works on all of these:
- A VPS with a public address becomes an anchor others can dial, and — opt-in — a usable
exit. Turning on the exit means other people’s traffic leaves through your address, with the
same exposure as running any public exit. It is off by default for that reason. - A single-board computer on a home LAN becomes the bridge between that LAN and the
overlays: it holds the Tor, Yggdrasil and I2P sides so the phones and laptops around it do
not have to. - A laptop is a plain client that joins and leaves, and gets a local SOCKS5 port to browse
through the mesh. - Anything with a Wi-Fi radio can end up hosting a group for the devices around it, if the
election picks it.
Nothing above the link layer knows which interface carried a packet. If Tor dies mid-session,
the next announce re-establishes the path over Yggdrasil or QUIC. The destination hash does not
change, so nobody re-adds anybody.
What is ready
Running today: TCP/IP, UDP, Tor (an external daemon, or an in-process client), I2P over SAM,
Yggdrasil, iroh/QUIC with hole punching, and ICMP echo — frames riding inside ping payloads,
where the client side needs no privileges at all. On top of the transports: LXMF messaging, a
SOCKS5 ingress and an L3 VPN that routes flows into the mesh.
Being built right now: BLE, and Wi-Fi Direct, where the daemon raises a P2P group through
whichever of NetworkManager, iwd or wpa_supplicant holds the radio.
The node is backwards compatible with the reference Python implementation, so it joins the
existing network as a peer rather than starting a parallel one.
A mobile client is coming
Not as a rewrite: the phone links this same node as a shared library through its C ABI, so the
transports, the identity handling and the delivery logic are literally the same code as on a
VPS. That is the reason the C ABI exists at all.
It is not released yet, and we are not giving a date — when it is out, it will be a post here
with a link, not a promise.
Why a devlog
The interesting part of this project is not the feature list, it is the decisions. How BLE peers
elect who hosts a group. What the covert ICMP transport can and cannot hide. What broke when a
link had to survive its interface dying.
New entries go out with each release, plus whatever is worth writing up in between. The current
release is v0.2.3.
Code, AGPL-3.0: https://github.com/Resilum/resilum-core
Write a comment