Documentation
TZX Mesh is a WireGuard mesh with a control plane you run yourself. These pages cover the whole path from a blank VPS to a working private network, in the order you will need them.
Start here
- Install the control plane on a Debian or Ubuntu VPS, one command.
- Add your first device with a setup key or a login.
- Turn on device approvals so every new device waits for you.
Then
- Setup keys for servers, containers and fleets.
- Exit nodes to route a device's whole internet through a peer.
- Routes and DNS to reach private subnets and name your peers.
- Access control to decide who talks to whom.
- Clients for every platform.
- Backups and upgrades so the control plane survives you.
How the pieces fit
| Piece | Where it runs | What it does |
|---|---|---|
| Control plane | your VPS | keeps the list of devices, keys and policies; hands each device the map of peers it may reach |
| Signal + relay | same VPS | helps two devices find a direct path; carries encrypted traffic only when NAT blocks the direct path |
| Console | same VPS, at your domain | the web interface: peers, Warden inbox, keys, policies, routes |
| Identity | built in, or your own OIDC provider | who can sign in and administer |
| Clients | every device | WireGuard tunnels between peers; talk to the control plane over HTTPS |
Traffic between devices never passes through the control plane. The control plane decides who may talk; WireGuard does the talking.