Documentation
VIGIL-MESH glossary
The terms used throughout the VIGIL-MESH documentation, defined briefly and precisely. Some designate roles (node, vigie, controller), others network objects (netmap, broadcast domain) or cryptographic building blocks (raw public keys, post-quantum hybrid). The links point to the pages that detail each notion.
Roles, infrastructure and addressing
| Term | Definition |
|---|---|
| Node | A machine that is a member of the network (workstation, server, device). It opens no inbound port: it only makes outbound connections and establishes its direct paths through NAT traversal. |
| Vigie (blind relay) | A public relay and NAT-traversal coordinator. It carries already-encrypted packets it cannot read (no session keys) and opens three inbound ports (udp/443, udp/4433, tcp/443). See /en/docs/reseau-mesh. |
| Private vigie | A vigie you host, whose scope is locked by the controller to a single workspace: it only serves your networks and does not appear in the global directory. See /en/docs/vigie-privee. |
| Controller | The server (web service) that coordinates the workspace: it issues the tokens, qualifies the vigies, manages identities and policy, and publishes the signed network maps. The network's source of truth. |
| Workspace | The logical perimeter that members, networks and vigies belong to. The scope of a private vigie is tied to exactly one workspace. |
| Netmap (signed network map) | The map of the network — members, addresses, vigies, rights — signed by the controller and distributed to the nodes. Removing a member from the netmap is part of their immediate revocation. |
| MagicDNS | Name resolution internal to the network: each node is reachable by a stable name rather than an IP address to remember. |
| Signed generation | A numbered, signed version of a distributed state (for example a netmap). The signature and the generation number prevent a forged or replayed state from being accepted. |
| ACL | The access control rules (Access Control List) defined at the controller level: they decide which members can reach which networks or services. |
| Session migration | A QUIC property that lets a session survive a change of address or path (network change, vigie failover) without being cut. |
Network, broadcast, security and integrations
| Term | Definition |
|---|---|
| L3 overlay | The overlay network operates at the IP level (layer 3): nodes exchange IP packets on top of the public Internet. See /en/docs/reseau-mesh. |
| Near-L2 | A service that reproduces, on top of the L3 overlay, layer-2 local-network behaviors — notably group broadcast — without being true bare L2. See /en/docs/l2-multicast. |
| Broadcast domain | The set of members that share the same broadcast, like machines plugged into the same physical switch. Any authorized member of the domain sends and receives these broadcasts. |
| Multicast | Delivering the same stream to several receivers. The vigie replicates (fans out) the encrypted packets to the group members without being able to read them. |
| Sender key | The key under which a sender encrypts its group broadcasts. It rotates when a member is revoked, on a reconnection or a restart, and at the latest every 24 hours. See /en/docs/securite. |
| Storm control | The mechanism that limits broadcast/multicast storms to prevent a runaway stream from saturating the broadcast domain. |
| Datagram | An unreliable QUIC message (no retransmission, no guaranteed ordering), suited to real-time streams where late data is worth less than lost data. |
| QUIC | The UDP-based transport protocol that carries the sessions: multiplexing, built-in encryption, session migration. See /en/docs/reference-ports. |
| TLS 1.3 | The version — and the only one accepted — of the encryption protocol that secures the QUIC sessions end to end. |
| Raw public keys (RPK) | Peer authentication by raw Ed25519 public key (RFC 7250), with no X.509 certificate chain to manage: the public key directly identifies the peer. |
| Post-quantum (X25519 + ML-KEM768) | The hybrid key exchange of the QUIC sessions: the session key depends on both mechanisms at once and stays safe as long as either holds — a defense against “harvest now, decrypt later”. See /en/docs/securite. |
| RTSP / RTP | Media streaming protocols (RTSP for control, RTP for stream transport), typical of cameras and of video carried over the mesh. |
| MCP | Model Context Protocol: a standard protocol connecting agents/models to tools and data sources, mentioned for integration use cases. |