Yggdrasil on Ubuntu 24.04 LTS by cloudimg

Yggdrasil is an early stage implementation of a fully end to end encrypted IPv6 mesh network. It is decentralised and self arranging: every node derives a permanent, cryptographic IPv6 address in the 0200::/7 range from its own key, and nodes automatically build a spanning tree between their peers so that any node can reach any other over the encrypted overlay, without a central server, and without you having to plan an address scheme. The result is a flat private IPv6 network that follows your machines across NAT, changing IP addresses and different clouds, so services keep the same address wherever they run.

This image delivers Yggdrasil fully installed and configured on Ubuntu 24.04 LTS, running as a hardened systemd service, so a working overlay node is up within minutes of launch. The node brings up a TUN interface and its own stable overlay IPv6 address on first boot, and is managed with the yggdrasilctl command line tool over a local only admin socket, so the management interface is never exposed to the network. A single peering port is opened so that your other nodes can dial in and form encrypted links; all overlay traffic between nodes is authenticated and encrypted with each node's key.

Application stack: the node runs the single yggdrasil binary as a systemd service and is administered with yggdrasilctl over a Unix domain socket. The peering transport listens on port 9001 over TCP with TLS, which is the only network facing surface the image opens besides SSH. There is no database and no central controller to deploy, patch and keep highly available; a node participates in the network purely by peering with other nodes.

Secure by default: this image ships with no known credentials and no baked in key of any kind. A node's key is its identity on the network, so a shared or default key would let anyone impersonate your node and would give every instance the same address. On the first boot of your instance a one shot service generates a unique node key for this VM alone, writes the configuration with strict permissions, derives this node's overlay IPv6 address, subnet and public key, and records them in a root only file for you. The admin socket is a local Unix socket so it can never be reached from the network.

Key capabilities: a self arranging, end to end encrypted IPv6 overlay with a stable cryptographic address per node; connectivity that survives NAT and changing underlay IP addresses; a single self contained binary with no database and no central server to operate; and simple growth by launching more of these images or installing the free Yggdrasil client on your own machines and peering them together.

Get started: read your node's overlay IPv6 address and public key from the credentials file on this VM, then peer your other machines to this node by adding its endpoint to their Peers list, or add remote endpoints to this node's configuration to join a wider network. cloudimg engineers can help you design peerings, restrict who may connect, expose services over the overlay, and upgrade Yggdrasil after purchase.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.