Threatmatic · EdgeGuard + π
Every point below is a real, physical VM — not a data center you'll ever think about. Each one wears several hats at once, and your traffic finds the nearest one on its own.
six regional VMs, two per region — the shape of the rollout, not a finished map
01
A node in the constellation isn't a single-purpose box. Each regional VM runs EdgeGuard (volumetric defense), π (payload inspection), EdgeScale Ingress (published-hostname delivery), and Cloudiffusion (private datacenter and cloud reach) at the same time — one physical machine wearing four hats, not four machines per region.
02
EdgeGuard and π live on the same VM for a real reason, not convenience: EdgeGuard manipulates host-level state directly — nftablesrules and an XDP/eBPF program attached to the real network interface — so it runs bare, as its own systemd service. π's inspection work is ordinary, privilege-free userspace, so it runs containerized. Same machine, because they belong to the same regional footprint. Different processes, because they need fundamentally different levels of trust from the host.
Bare systemd service. Needs direct host network-interface access — a container boundary would only get in its way.
Runs in Docker. Ordinary userspace proxy work, no special privileges required at all.
03
Every node advertises its own /32over qschannel, the same overlay every device already uses. That single decision does more than avoid a public listener: it means access control comes free from the tunnel's own handshake — only devices already part of the mesh can reach a node at all — and a device roaming between networks never drops the connection the way a raw TCP session would.
Which specific node a device uses isn't hard-coded. It's a decision the control plane can make and change live, geo-aware, over the same persistent channel that already pushes policy — the nearest healthy node today doesn't have to be the nearest healthy node next quarter.
04
Not one node per region — two, for redundancy from day one. This is the planned footprint, honestly staged as a build-out rather than a finished network:
A constellation isn't a bigger star. It's more points of light, close enough together that something is always nearby.
Six VMs today, each already doing four jobs at once. The map grows one honest region at a time — see the current rollout status on Landing Soon.
← Back to The Wire