Responsibilities
Control authenticates administrative sessions and devices, scopes membership by network, handles enrollment, stores topology/ACL policy, signs device configuration snapshots, and coordinates endpoint exchange and NAT rendezvous.
Topology policy
Current policy modes are FULL_MESH and SELECTIVE. SELECTIVE snapshots list authorized neighbors. MeshDaemon applies that list across inbound/outbound sessions, reconnect, NAT, and relay fallback; telemetry does not grant authorization.
ACL
Network-scoped ACL CRUD is exposed through authenticated Control API routes for OWNER/ADMIN. Mutations validate network membership, update config version, and are auditable. The dataplane applies a validated snapshot atomically and defaults to DENY when no rule matches. ACL policy does not override topology restrictions.
Configuration snapshots
Agents synchronize signed, versioned snapshots and cache the last valid configuration. A failed or unavailable Control connection does not authorize a new peer. Existing sessions may continue using the last valid snapshot until policy can be refreshed.
What Control does not do
Control's HTTPS APIs do not tunnel application or overlay IP traffic. Packets travel over DVeProto peer sessions or through a separate ciphertext relay path.
Deployment state
The source includes a Control implementation and deployment documentation. This site does not operate or publish a public Control endpoint, and no public Control service availability is implied.