Skyglide for desktops and servers. Skyglide gives each member a private network for their devices: at a participating location the Wi-Fi puts a device into it, and everywhere else a Skyglide client does. This repository holds the clients written in Rust:

skyglided, the service. It runs with the privileges a tunnel needs, holds the device's private key, runs a standard WireGuard tunnel to the Skyglide cloud, and applies routes and DNS.
skyglide, the command-line client for servers and desktops. It controls the service over a local socket; every command takes --json.
skyglide-desktop, the tray app for Mac, Windows and Linux: a tray menu and a window (egui) that control the same service.

The iPhone and iPad app lives in skyglide.com/swiftapp, the Android app in skyglide.com/androidapp, the public site in skyglide.com/landingpage.

Issue Reporting and Security

For reporting bugs, issues, or security vulnerabilities, please visit community.foss.global/. This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a code.foss.global/ account to submit Pull Requests directly.

State

This is the first cut, built ahead of the Skyglide cloud. The controller the clients sign in to does not exist yet, so:

Built and tested on Linux: the service's state machine, the device key, the userspace WireGuard data path, routes for "private network only" and "Internet through Skyglide", location detection, removal and restriction handling, the local socket with its access check, the command-line client, and the tray app's window and tray menu.
Waiting for the controller: signing in (skyglide login, the app's "Sign in with your browser") and joining with a join key answer that the controller is not built yet. A development file can stand in for the controller (below).
Not built yet: the Windows named pipe, service and routes; DNS on macOS. The command-line client and the tray app type-check for macOS; nothing has run on macOS or Windows yet. The kernel WireGuard path (Linux) is built but untested.

How it works

A device away from a location is one WireGuard peer of the Skyglide cloud, with a fixed address in its member's away subnet. By default only the member's private network and its DNS go through the tunnel; with Internet through Skyglide all traffic does, IPv6 included, and the cloud inspects it. After every network change the service asks the controller where the device is: when the answer names the device's own member network (it is on skyglide.com at a location), the tunnel stays idle. A Wi-Fi name alone never idles the tunnel.

Build

Rust 1.95 (see rust-toolchain.toml).

cargo build -p skyglided -p skyglide-cli -p skyglide-desktop

On Linux the tray app needs libxkbcommon-x11 at run time and a StatusNotifierItem host (KDE, most desktops; GNOME with the AppIndicator extension).

Use

Install and start the service, then let your user control it:

sudo skyglide service install

sudo usermod -aG skyglide "$USER"

Then skyglide status, skyglide up [--internet | --private-only], skyglide down, skyglide devices, skyglide ip, skyglide ping <device>, skyglide netcheck. A server enrols with a join key from the member portal, read from a file (mode 0600) or standard input, never from the command line:

skyglide up --join-key-file /etc/skyglide/join.key --name build-server

Development without a controller

skyglided --dev-config <file> takes the device configuration from a TOML file instead of the controller and reads it again on every refresh, so editing it acts like a push from the controller:

[device]
network = "net_alice"
device_name = "build-server"
address_v4 = "10.42.0.9"
private_prefixes = ["10.42.0.0/24", "10.42.1.0/24"]
dns = ["10.42.0.1"]

[device.hub]
endpoint = "hub.example.net:51820"
public_key = "<the hub's WireGuard public key>"

# optional: what the controller answers to "where am I?"
[location]
network = "net_alice"
site = "Location A"

Set removed = true at the top to act out a removal in the member portal, billing = "restricted" under [device] for a restricted membership.

Test

cargo test --workspace

ci/e2e/run.sh tests the data path in Docker against an independent WireGuard hub (boringtun-cli): connection, reachability both ways, forged source addresses, location detection, Internet through Skyglide, switching off, removal. ci/shots.sh takes screenshots of the tray app's window against a running service and reads its tray menu back over D-Bus. Both need Docker and /dev/net/tun; see their headers.

License and Legal Information

This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the repository license file.

Please note: The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.

Trademarks

This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH or third parties, and are not included within the scope of the MIT license granted herein.

Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines or the guidelines of the respective third-party owners, and any usage must be approved in writing. Third-party trademarks used herein are the property of their respective owners and used only in a descriptive manner, e.g. for an implementation of an API or similar.

readme.md

@skyglide.com/rustapp