Documentation
Configure enrollment: keys, invitations, approval
Enrolling a machine means authorizing a device to join your workspace. VIGIL-MESH offers three methods depending on the type of machine: a limited-use pre-authorized key for a screenless server, a short-lived invitation for a workstation driven by a person, or an approval queue when every request must be validated by hand. Each device receives its own Ed25519 identity, the controller distributes a signed network map, and revocation takes effect immediately. This page describes how to set up these methods and the device lifecycle; the step-by-step of a first enrollment is detailed in /en/docs/demarrer-enrolement.
The three methods
The choice of method depends mostly on the machine: is it headless or driven by a person, and do you want to validate every membership by hand? The three routes lead to the same result — an active device in your workspace — but do not offer the same safeguards.
| Method | When to use it | Safeguards |
|---|---|---|
| Pre-authorized key | Servers and headless machines, automated deployments, images to clone. | Limited use: number of uses and validity period bounded, revocable at any time. |
| Short-lived invitation | The workstation of a person you know, one-off commissioning. | Link or code with a short lifetime and restricted use, which expires on its own. |
| Approval queue | Environments where every membership must be validated by an administrator. | The machine stays pending until explicit approval in the console; refusal is possible. |
Scope and lifetime of keys and invitations
A pre-authorized key or an invitation is not an eternal password: it is a limited-use enrollment secret. You give it a scope (the perimeter it authorizes) and a lifetime (beyond which it is worth nothing). Issued just before deployment, restricted to the intended perimeter and revoked as soon as it is no longer useful, it sharply reduces the exposure window.
- Number of uses: a pre-authorized key can be limited to a single enrollment or to a defined number, useful for a batch of machines to clone.
- Expiry: keys and invitations carry a validity date beyond which they expire on their own, with no intervention.
- Short lifetime for invitations: intended for a person, they have a brief lifetime and restricted use, which limits the risk if the link leaks.
- Revocability: a key or an invitation can be revoked at any time, which cancels it even if its expiry has not been reached.
Lifecycle of a device
An enrolled device is not frozen: its status evolves over its life in the workspace. These states are read and driven from the console, and they determine whether the machine can communicate on the mesh.
- Active: the device is authorized and participates in the network; it sends and receives traffic according to the access policies.
- Suspended: access is paused, without deleting the device or its identity. Useful for a machine temporarily out of service or under investigation; it can be reactivated.
- Revoked: authorization is withdrawn permanently. The device immediately loses access to the network and would have to be re-enrolled, with a new identity, if it must come back.
- Expired: the authorization has reached its term (invitation or key run out). The device is out of the network as long as it is not re-authorized.
Immediate revocation
Revoking or suspending a device cuts its access without waiting. The removal is reflected in the signed network map the controller redistributes: as soon as the updated netmap is propagated, the removed device no longer appears in it as an authorized peer, and the other nodes stop accepting its sessions. It loses peer reachability as well as reception of broadcasts.
This mechanism rests on each machine's cryptographic identity. At enrollment, the device generates an Ed25519 key pair: the public key becomes its stable identity in the workspace, the private key never leaves the machine. The controller signs the netmap, so a node rejects any topology not signed by it — and therefore any device that has been removed from it.