VeilNet

Quick Start

Install conflux on two machines and connect them on the instance VeilNet hosts, with no account and no configuration.

Needs
Two machines with root or Administrator access, and outbound internet access
Takes
About five minutes

Joining Two Machines

The instance VeilNet hosts is for trials and personal use. A machine joins it the first time it runs conflux. The only thing you copy from one machine to the other is a taint, a label that puts both machines in the same compartment.

Fig. 01 — One taint, two machines
THE INSTANCE VEILNET HOSTSapi.veilnet.com.auONE HTTPS CALL PER MACHINE · NO ACCOUNT · NO RECORDHTTPSHTTPSMINTED BY A · COPIED TO B BY YOUbrhk-2mq9-tzva-6pjs-k4xe-nw7d-qfDATA YESmachine A10.128.0.1/24machine B10.128.0.2/24A MACHINE IN ANOTHER TAINTDATA NO, WITH EITHER

Each machine enrols with one HTTPS call and gets its own identity and credential back. The instance keeps no record of either. The first machine mints the taint, and you copy it to the second. The two machines then find each other on the overlay and exchange data. A machine enrolled with any other taint is admitted to the same realm but cannot exchange data with either of them.

0 of 4 done

  1. Conflux is a single binary of about 50 MB. It includes the anchor daemon, anchord, and its control tool, anchorctl.

    Download the build for each machine and the SHA256SUMS file from the pre-release page. Check the download, install the binary in a directory that persists across reboots, and confirm the version:

    $ sha256sum -c SHA256SUMS --ignore-missing
conflux-linux-amd64: OK
$ sudo install -m 0755 conflux-linux-amd64 /usr/local/bin/conflux
$ conflux version
conflux 1.0.0-pre (f47de0fac83d24489664ca15fc6a317ac9c9f683) linux/amd64
anchor set <set id>
  anchord    <sha-256>
  anchorctl  <sha-256>

    You should see OK for the download, then the conflux version.

    On Windows, open PowerShell with “Run as administrator” and leave out sudo. On macOS, if the system refuses to open the download, clear the quarantine flag:

    $ xattr -d com.apple.quarantine conflux-darwin-arm64

    For every other platform, see Installation.

The Result

  • Each machine has its own identity, and an overlay IPv6 address derived from it. No one assigned the address, and it does not collide with another machine's address.
  • The two machines have a route between them. The route is direct where the network allows it. Otherwise, it goes through a relay that cannot read the traffic.
  • The two machines share a compartment. Only a machine enrolled with the same taint can exchange data with them.
  • After a reboot, the boot service starts the anchor again, so you do not need to do anything. The credential lasts 30 days and renews itself at day 20. The machine keeps the same AnchorID and overlay address.

To install conflux on other platforms and manage the boot service, see Installation. To run a machine without a network interface, see Proxy and TUN Modes.

Joining a Sovereign Network

A sovereign network belongs to your organisation and runs on its guardian, your organisation's control suite. Machines cannot enrol themselves on a sovereign network, so steps 2 and 3 work differently.

You commission each machine in the guardian console. The guardian then gives you one file for the machine, the manifest, which holds its credential. The credential sets the machine's taints, so start the machine without --taint. Install the manifest, then start the machine:

$ sudo conflux enrol --manifest node-14.b64
$ sudo conflux up

Install conflux and check the connection as in steps 1 and 4. For the full procedure, including the output of enrol, see Joining a Sovereign Network. To learn how the guardian creates the manifest, see Commissioning Machines.