NetBird is a configuration-free peer-to-peer VPN and centralized access control system built on WireGuard. It consists of a cross-platform client daemon (Linux, Windows, macOS, Android, iOS, FreeBSD, WebAssembly), a management server, a signal server for NAT traversal coordination, a relay server for fallback connectivity, and a reverse proxy with an LLM gateway layer. The client daemon manages WireGuard interfaces, DNS, firewall rules, and peer connections via ICE/STUN/TURN, while the management server provides REST/gRPC APIs for account management, network map computation, posture checks, and policy enforcement. The proxy component adds middleware for authentication, LLM request parsing, cost metering, and guardrails, enabling identity-aware access to private resources and AI APIs over the encrypted tunnel. Architecturally, the system is a distributed set of microservices: the client runs as a background daemon with a CLI and a desktop GUI (Wails v3 + React), communicating with the management server via gRPC and REST. Relay and signal servers facilitate NAT traversal, and the proxy can be deployed as a standalone reverse proxy. The management server supports multiple database backends (PostgreSQL, SQLite, MySQL) and caching via Redis. Telemetry and metrics are exported to Prometheus or InfluxDB. The codebase is heavily platform-adapted with build-tagged files, and includes extensive unit, integration, and end-to-end tests. Key entry points include client/main.go (CLI), client/ui/main.go (desktop GUI), management/main.go (management server), relay/main.go (relay server), signal/main.go (signal server), proxy/cmd/proxy/main.go (proxy), and combined/main.go (all-in-one server). Data flows involve client authentication, network map retrieval, WireGuard tunnel setup, peer-to-peer connection establishment via ICE/relay, and optional proxy middleware processing for HTTP/LLM traffic. External dependencies include WireGuard, PostgreSQL/SQLite/MySQL, Redis, MaxMind GeoLite2, pyroscope, gRPC, protobuf, Wails, and various system tools (iptables, nftables, resolvconf).
EdgeVPN is a decentralized peer-to-peer VPN and overlay networking tool built on libp2p. It provides a VPN tunnel (TUN interface), TCP service tunneling (ngrok-like), HTTP egress proxy, DNS resolution, file transfer, and a distributed ledger for network state coordination. The architecture is a single Go binary with an embedded React SPA dashboard, exposing a REST API (Echo framework) and CLI (urfave/cli v2). The core innovation is a blockchain-style ledger that stores machine, service, DNS, and health records, with optional signed ownership enforcement and liveness-based reaping. The system uses libp2p for peer discovery (DHT, mDNS), pubsub (gossipsub), relays, and circuit v2. It is designed for decentralized networks without central coordination, and is used in production by Kairos (Kubernetes) and LocalAI (P2P distribution). The codebase demonstrates strong engineering with functional options patterns, comprehensive test suites, documentation generation from CLI code, and a design system for the React UI. However, it carries technical debt from experimental features (PeerGuard, DHCP, IPv6), a forked libp2p-pubsub dependency, and documentation drift that requires manual regeneration.
This repository is the deployment system for Internet-in-a-Box (IIAB): an offline-first learning server for schools and communities without reliable Internet. It is an Ansible configuration-management application that installs and configures a complete local network stack — nginx reverse proxy, PHP-FPM, MySQL/PostgreSQL, hostapd WiFi access point, dnsmasq DNS/DHCP, Squid proxy, captive portal, Samba, CUPS — alongside a catalog of educational services such as Kiwix (offline Wikipedia/ZIM), Kolibri, WordPress, MediaWiki, Nextcloud, Gitea, JupyterHub, Moodle, Calibre-Web, and an offline OpenStreetMap/vector-tile mapping system with geocoding. Python, PHP, and Jinja2 templates generate systemd units, nginx virtual hosts, and app configs for every deployed service. Architecture is a staged Ansible pipeline: eleven role groups (0-init through 9-local-addons, then network) are driven from top-level playbooks (iiab-stages.yml, iiab-from-cmdline.yml) invoked by shell entry points (iiab-install, iiab-configure, iiab-network). Every role follows consistent conventions: defaults in defaults/main.yml, an install.yml and enable-or-disable.yml, boolean *_install/*_enabled flags validated up front with Ansible assert tasks, install state recorded in /etc/iiab/iiab_state.yml, and disk usage audited into iiab.ini. A custom Ansible module (get_curl) performs resumable/atomic downloads used across roles. Content provisioning is data-driven: maps and ZIM catalogs are generated (roles/maps/generate-catalog.py) and fetched at install time; offline search and geometry utilities (FQR, static_search.js) are bundled into the served front end. The project is actively developed (Ubuntu 24.04 and Raspberry Pi OS CI matrices, expected-state integration tests) but carries heavy legacy baggage: a large 0-DEPRECATED-ROLES tree, numerous .unused files, Python 2 support scripts, hardcoded versions/vendor URLs, plaintext default secrets, and fragile per-distro workarounds. The reusable gems — the custom download module, the tested geographic FQR geometry utility, the client-side static geocoder, the Ansible facts script, and the pdsm proot service manager — are isolated enough to extract into new projects. Overall it is a solid, professional infrastructure-as-code project with a few genuinely reusable components, tempered by significant accumulated technical debt.