Eryon
Project home
Browse documentation

Eryon technical portal

Architecture

One topology authority. One managed overlay dataplane. A narrow read-only interface for Eryon.

Source-groundedUpdated 2 November 2026Development status

Components

  • Eryon Core offers local application-facing runtime abstractions, a persistent local registry, CLI diagnostics, and a DVeMesh IPC adapter.
  • DVeMesh owns the managed node daemon, Control synchronization, authorized topology, TUN, UDP, peer sessions, route learning, packet forwarding, NAT traversal, and relay fallback.
  • DVeProto provides identity and encrypted session mechanisms used by DVeMesh.
  • Control authenticates network membership and distributes signed configuration and policy snapshots. It is not a user-packet router.

Control Plane

Control stores networks and devices, handles enrollment, issues configuration snapshots, manages topology policy, ACL rules, and rendezvous metadata. MeshDaemon verifies and caches signed configuration. During a Control outage, a node can retain its last valid configuration and existing sessions; changes and new coordination can be unavailable.

Data Plane

MeshDaemon is the single owner of the TUN interface, UDP listener, peer session manager, routing, packet forwarding, NAT logic, and relay allocations. Eryon does not instantiate a competing DVeMeshPeerClient in the managed path. Its Unix socket interface only returns status snapshots.

Request and packet flow

  1. An administrator enrolls a node into a Control network.
  2. Control returns a signed snapshot with the local device, network, peers, topology policy, ACL, and relevant endpoints.
  3. MeshDaemon reconciles only policy-authorized peers and owns session attempts.
  4. DVeProto establishes a protected session; DVeMesh checks peer identity/network metadata before declaring it healthy.
  5. IPv4 packets pass validation and ACL evaluation; a direct peer or learned next hop is used if available.
  6. Eryon CLI reads daemon state through local credential-checked IPC.

Compatibility and limits

The components are present in one source tree and bundled by the current Installer packaging. A stable public compatibility matrix and a production release channel are not established. Local automated tests are not a substitute for three-host UDP and TUN validation.