Service mesh based on rathole and traefik
Consists of three different applications to operate
A service discovery application, used by ratkings and ratlings
Controlplane application starting rathole servers, must be reachable for all ratlings
Dataplane application managing rathole clients and traefik proxies, can be completely isolated
Rathole tunnel traffic between kings and lings can be encrypted using the Noise protocol (NK pattern). Generate a keypair with rathole --genkey and pass the keys to the king:
king --noise-private-key="<base64-private-key>" --noise-public-key="<base64-public-key>" ...The king sends its public key to the council, which distributes it to lings via state. Lings automatically enable encryption when connecting to kings that have a noise public key. Kings without noise keys continue to work unencrypted.
For proxy traffic or additional defense-in-depth, network-level encryption via Nebula or VPN is still recommended.
Install docker and call docker swarm init
See stack.yml for deployment configuration
./example_deploy.shnodejs >=18.x.x
node src/start-dev.mjs