RobOS App Mesh

Zero-Trust App & IPC Port Mesh for connecting RobOS applications across machines (mTLS 1.3, OpenZiti, Tailscale, NetBird, WireGuard)

packages/app-mesh

RobOS App Mesh creates a private, provider-agnostic Zero-Trust network specifically for RobOS applications and their IPC/service ports across machines—whether on the same LAN or across different networks.

Key Capabilities

  • Provider-Agnostic Transport Fabrics:
    • Built-in Zero-Trust mTLS 1.3 (mtls): Pure Node.js Mutual TLS 1.3 with X.509 ECDSA P-256 peer certificate SHA-256 fingerprint pinning. Works out of the box with zero external daemons or root privileges.
    • OpenZiti Overlay Fabric (openziti): Dark-network service/intercept configuration generator (robos.ipc.<app-id>) and edge tunnel integration.
    • Tailscale / Headscale (tailscale): WireGuard overlay mesh routing and least-privilege HuJSON ACL export.
    • NetBird Zero-Trust P2P (netbird): WebRTC + WireGuard NAT-traversal P2P mesh support.
    • Native WireGuard (wireguard): Dedicated wg0 / wg-robos0 interface binding.
  • Full RobOS App IPC & Service Port Catalog: Bridges all registered RobOS DOM Snapshot / IPC ports (19100–19231) plus service ports (Point of Sale :3410, Smart TV & Dashboards :19210, Party Game :19213, and IntelliJ IDEA IPC :63343) with per-app allow/block ACL toggles.
  • 1-Click Live Zero-Trust Proof: Built-in cryptographic verification that proves unpinned rogue certificates are rejected while authorized peer IPC tunnels pass /health and /snapshot traffic over TLS 1.3.

More in Security & Credentials

DocuVault Desktop Offline-first secure markdown notes, personal snippet vault, and local workstation storage starter app. Git Login Manager Checks that GitHub access works (gh login, SSH key, SSH connection, git identity) and walks you through fixing what fails. Pass Manager Vault Desktop front end for the standard Unix password store (pass), with entries encrypted by GPG. Pass Unlock Daemon Small dialog that asks for your GPG passphrase once a day and caches it in gpg-agent. RobOS Cloud Accounts One list of your cloud accounts, shared with Data Sources and Google Calendar; Google accounts can sign in through the browser and be written into Thunderbird. RobOS Setup Wizard Eleven-step first-run wizard for GPG, pass, pinentry, git identity, SSH, Chrome, GitHub login, AI agent keys and optional tools. RobOS VPN Sandbox Launch any desktop or CLI app inside an isolated Linux network namespace (ip netns) routed exclusively through OpenVPN with a 3-barrier kernel kill-switch. RobOS VPN Servers Manage OpenVPN providers (IPVanish built-in with 3,598 server profiles), encrypted VPN accounts, live TLS 1.3 credential tests, and server locations. Security Setup Wizard Five-step wizard that configures GPG pinentry, a GPG key, the pass store and an SSH key.