0024 (ADR-002): The mesh is the base, not an extra #29

New issue

Open

opened 2026-09-30 10:10:41 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-09-30 10:10:41 -03:00

(Migrated from github.com)

Decision (maintainer, 2026-09-30). WireGuard ships in Keel Core and every appliance can join a mesh, even alone. Tunnels are always initiated from inside to outside, so only outbound UDP is needed behind NAT or a firewall. IPv6 first: native IPv6 goes direct; IPv4-only nodes enter through a rendezvous point doing NAT64 (Tayga), hosted by nodes with a real edge and fixed addressing.

Handbook: docs/decisions/0024-the-mesh-is-the-base.md (handbook#26)

Amends: 0020 (the overlay was step 2 after M3 and key exchange was Keel Cloud's; now in Core from the start, membership in etcd). 0018 unchanged: it still governs /etc/wireguard/.

Review notes

The DNS successor for nodes behind NAT with changing IPv6 prefixes is undecided (PowerDNS plus etcd likely); tracked in the roadmap.

First tasks

Confirm the WireGuard overlay already in Core covers outbound-only initiation (persistent keepalive from the inside peer).
Design the rendezvous node: Tayga NAT64 plus a WireGuard hub, as an overlay.

**Decision (maintainer, 2026-09-30).** WireGuard ships in Keel Core and every appliance can join a mesh, even alone. Tunnels are always initiated from inside to outside, so only outbound UDP is needed behind NAT or a firewall. IPv6 first: native IPv6 goes direct; IPv4-only nodes enter through a rendezvous point doing NAT64 (Tayga), hosted by nodes with a real edge and fixed addressing. **Handbook:** `docs/decisions/0024-the-mesh-is-the-base.md` (handbook#26) **Amends:** 0020 (the overlay was step 2 after M3 and key exchange was Keel Cloud's; now in Core from the start, membership in etcd). 0018 unchanged: it still governs `/etc/wireguard/`. **Review notes** - [ ] The DNS successor for nodes behind NAT with changing IPv6 prefixes is undecided (PowerDNS plus etcd likely); tracked in the roadmap. **First tasks** - [ ] Confirm the WireGuard overlay already in Core covers outbound-only initiation (persistent keepalive from the inside peer). - [ ] Design the rendezvous node: Tayga NAT64 plus a WireGuard hub, as an overlay.