Features

WireGuard

Every connection is a WireGuard tunnel. The device holds the private key. The network assigns an address and a public endpoint.

The client generates an X25519 keypair. Only the public key is sent to NodeDistro VPN.
Addresses come from 10.80.0.0/16. Each server has its own /24, with .1 reserved for the gateway.
The config you import contains the client private key, the server public key, and the endpoint. It never contains the server private key.
Customers talk to the public API. They never call a node agent or receive node credentials.

Create an account and connect a device.

The device keeps its private key. The API assigns a server that is actually online.