Show HN: small WireGuard mesh VPN with no coordination server

I totally get the use-case. Interesting way to solve it. I will have to give it a try. Been using https://github.com/naggie/dsnet which is awesome but hub and spoke. The threshold-signed checkpoints are a key feature, I think. Until then, nothing prevents backdated or reordered operations from a sponsor or admin. Not a likely thing to happen but since there is no quorum, time would be my attack-vector.

Offering it in docker would be nice. docker run network host... easy join and test.

hi, this is a small side project... and I'm a bit nervous sharing it.

kith is a mesh VPN on top of WireGuard. the thought behind it was simple: I didn't want any coordination server.

## why I made it

I wanted my laptop, my home lab and a cheap VPS on one private network. Tailscale, Headscale and others already do this extremely well, and I've used them. but every one of them has a control plane that all the devices check in with, and I kept wondering what it would look like if the devices just handled it themselves.

I also wanted to make the networking decisions myself... how devices find each other, when to fall back to a relay, how names work, how exit nodes behave. building it was the best way to learn all of that.

## how it works, roughly

every network has a small signed ledger: who's a member, who's an admin, which names point where. each device keeps its own copy, and the copies sync with each other.

adding a device is basically "invite with a link". any member can let a new device in, and once it's in, everyone learns about it from the ledger. there's no account to make and nothing hosted that has to stay up, so if one machine goes offline the rest of the network would keep working. devices try to connect directly, through NAT, and if that doesn't work they relay through a machine you own (a cheap VPS is perfect for this). nothing goes through a server you don't control.

on macOS and Linux: - invite links and joining - direct connections, with relay fallback - internal names like nas.home.kith.internal - exit nodes, so your laptop's internet can go out through home or a VPS - phones and Windows through plain WireGuard (scan a QR code or import a config)

it's free and open source (AGPL), written in Rust, and installs with one line from the readme. there's no native Windows app, and I'm working on a small web console for managing devices.

I used a lot of Claude while building it, so I'm sure there are rough edges I haven't found... bad code, wrong docs, or maybe the wrong approach somewhere.

## feedback

I'd be really grateful for any feedback, especially on what's broken, what's confusing, or what could have been done differently. and if there's a problem it could actually help with, I'd love to hear it and try my best.

thanks for reading :)