Sovereign Networks
A sovereign network is your organisation's own tree of realms, and it runs entirely on your own infrastructure.
Your Organisation's Tree
Every VeilNet network is a tree of realms. A sovereign network belongs to your organisation because the key at its top is your organisation's realm key. Every credential in the tree descends from that key.
VeilNet mints your organisation's realm credential once, and hands it over on hard media such as a USB stick. The credential carries your realm key, so store and transport it as carefully as a code-signing key.
You set up your guardian from the realm credential. From then on, the guardian's signer signs every credential in your tree with the realm key. The key stays sealed inside the guardian, and is unsealed only for one signature at a time.
VeilNet mints your realm credential once and hands it over on hard media. From then on, your guardian's signer signs every credential beneath it with the realm key, which stays sealed inside the guardian. The guardian runs its own root node in every realm to issue that realm's commands. Bootstrap nodes in your realm relay encrypted traffic for the sub-realms beneath it. Machines exchange data only inside their own sub-realm, so two sub-realms can use the same address range.
Machines you joined in the quick start are on the instance that VeilNet hosts, which is a separate network. To bring a machine into your tree, commission it in your guardian.
Parts of a Sovereign Network
A sovereign network has these parts:
| Part | What it is | What it does |
|---|---|---|
| The guardian | Your organisation's control suite, on your own infrastructure. You set it up from the realm credential. | Keeps your realm key sealed, and its signer signs every credential. In its console, you mint sub-realms and commission and revoke machines. It renews every credential, gives every machine its bootstrap list and stores telemetry. It is not on any data path. |
| Root nodes | The guardian's own anchor in each realm, hosted inside the guardian. The console calls it the admin node. | Issues its realm's commands: blocks, taint moves, telemetry orders and changes to the networks a subnet router serves. It holds no key. It holds the block, taint or subnets power only for the one action it is carrying out. |
| Bootstrap nodes | A few of your own machines with publicly reachable addresses, commissioned into your organisation's realm | They come first in every machine's bootstrap list, and relay for every realm beneath them. They exchange data only inside their own realm, and cannot read the traffic they relay. |
| Sub-realms | One per site, department or team, each with its own key and a delegation from your realm | Each admits its own machines and has its own IPv4 range. Data never passes between sub-realms. |
| Machines | Every other machine, each running conflux | A machine needs no public address. It exchanges data only inside its own realm, and only with machines whose taints are compatible with its own. |
Commands stop at a realm's boundary, so a command reaches only the members of the realm it was issued in. A realm above can relay a sub-realm's traffic, but cannot block its machines or send them orders. For this reason, the guardian runs a root node in every realm, not just at the top.
Each machine finds the network through its manifest, the single file you install on it. The manifest carries the machine's identity, its credential and the bootstrap list, with your bootstrap nodes first. Every renewal updates the list, and the guardian itself is never a bootstrap peer.
Sub-realms
Sub-realms divide your network into groups of machines that cannot exchange data with each other. The depth limit in your realm credential decides whether you can have them.
At 0, your tree has no sub-realms, and every machine is commissioned into your organisation's realm as a bootstrap node with a publicly reachable address. At 1 or more, your guardian can mint sub-realms directly beneath your organisation's realm.
Create a sub-realm for each group of machines that must exchange data only with each other, such as a site, a department or a team.
The address 10.20.0.5 in one sub-realm and the same address in another are two separate addresses, and traffic never passes between them. Each site can therefore keep its existing address plan.
Keep a gateway in the same sub-realm as the devices it routes for. Choose a machine's realm before you commission it, because moving it to another realm means commissioning it again.
Running Disconnected
Nothing in your tree needs to reach VeilNet. The guardian, its root nodes, your sub-realms and every machine run on your own infrastructure. They run with or without an internet connection, including on air-gapped networks.
Your realm credential expires, and a new credential replaces it before it lapses. Online, Offline and Expired explains how. If the realm credential ever does lapse, nothing inside your tree stops:
- Your guardian keeps commissioning, renewing and revoking machines.
- Every machine keeps exchanging data.
- Every address stays the same.
Responsibilities
This table shows who handles each job in a sovereign network:
| Job | Who | How |
|---|---|---|
| Realm credential | VeilNet, once | Minted and handed over on hard media, then kept sealed in your guardian |
| Signing credentials | Your guardian's signer | When you commission a machine or mint a sub-realm, and at every renewal. Each machine gets one file |
| Renewal | Your guardian | Automatic, at two thirds of a credential's life and at every start. A credential lasts 90 days by default, which is also the maximum |
| Bootstrap | Your guardian, through each manifest and every renewal | The list names your bootstrap nodes first |
| Relaying | Your bootstrap nodes for every realm beneath them, and any member for its own realm | Never between sibling realms |
| Admission, routing and data | Every machine, with its peers | No server is involved |
| Commands | The guardian's root node in each realm | Only inside that realm |
| Console and telemetry | Your guardian | On your own infrastructure. Telemetry is on by default |
| Removing a machine | You, in the console | Revoke it, and it is never renewed, so it is gone for good when its credential expires. Block it to remove it sooner |
| Data path | Your machines only | Neither VeilNet nor the guardian is on it |
| Air-gapped | Supported | Nothing in the tree needs the internet |