Skip to content

architecture.md

Latest commit

 

History

History
137 lines (87 loc) · 3.03 KB

architecture.md

File metadata and controls

137 lines (87 loc) · 3.03 KB
Raw

VX6 Architecture

VX6 is a small stack with a few clear layers.

1. Identity

Every node has:

  • one Ed25519 identity keypair
  • one stable VX6 node ID derived from that key

This identity signs:

  • endpoint records
  • service records
  • DHT envelopes and catalogs

The display name can change. The key stays fixed.

2. Node Runtime

vx6 node is the runtime process.

It listens for:

  • discovery traffic
  • DHT requests
  • direct service sessions
  • relay extension traffic
  • hidden-service control and rendezvous traffic
  • file transfers

The same runtime is used on Linux, Windows, and macOS.

3. Service Model

VX6 is built around localhost-to-localhost service access.

That means:

  • the owner keeps the real app on 127.0.0.1
  • the client uses a local forwarder on its own machine
  • VX6 carries the stream between the two nodes

The app itself does not need to become directly public.

The frontend layers only help you publish, connect, inspect, and browse those services.

4. Discovery

VX6 has two discovery layers:

  • registry sync between known peers
  • DHT lookups for public, private, and hidden records

The local registry is a working cache. The DHT is the distributed lookup path.

The local registry helps startup and repeated sync. The DHT is the long-range lookup system.

5. DHT

The DHT stores a bounded distributed set of signed records.

Main record families:

  • node/name/...
  • node/id/...
  • service/...
  • private-catalog/...
  • hidden-desc/v1/...

Trusted keys use conservative store admission:

  • signed envelopes are required for trusted records
  • stale updates are rejected
  • repeated writes are throttled per source
  • ASN-aware diversity is used when a local ASN map exists

Important point:

  • not every node stores every record
  • each record is stored only on a small responsible set of nodes
  • diversity checks can use an optional offline ASN map when operators provide one
  • if no ASN map exists, the DHT falls back to the existing prefix-based diversity logic

6. Encryption

VX6 uses two different protection layers:

  • secure session encryption between nodes
  • layered relay protection for hidden-service paths

Hidden services also use:

  • encrypted hidden descriptors
  • blinded rotating lookup keys
  • invite secrets

That means a hidden invite is not just a name. It is the name plus a secret part that changes the lookup key.

7. Hidden Services

Hidden services use:

  • intro nodes
  • guard nodes
  • rendezvous nodes
  • encrypted and blinded descriptor lookup
  • onion-style relay circuits

Current result:

  • much stronger privacy than plain alias lookup
  • not a full Tor replacement

The browser frontend and GUI both sit on top of this same core. They do not change the protocol.

8. Transport

Current transport is TCP only.

The code keeps a transport abstraction so QUIC can be added later, but this build does not use QUIC.

9. Runtime Control

VX6 exposes a local runtime control channel for:

  • live status
  • reload requests
  • DHT publish health

This is the shared control model for Linux, Windows, and macOS going forward.