Documentation
Self-hosted mesh VPN: your relay, your sovereignty
With VIGIL-MESH, you can host your own relay — the “private vigie”. It registers automatically with the controller, serves only your workspace and remains structurally blind to your data. Let us be precise about the scope: you host the relay, not the control plane, which remains operated as SaaS.
What “self-hosted” means here
A VIGIL deployment has three roles: the nodes (your machines), the vigies (the blind relays that carry traffic and coordinate NAT traversal) and the controller (identities, directory, addressing). Self-hosting concerns the vigie: you run a relay on your own server. The controller, for its part, remains SaaS — we say so clearly, so as not to suggest fully self-hosted operation.
Why host your own vigie
Path sovereignty
Your relayed bytes only transit through your own machines.
Proximity
A vigie in your datacenter or your region shortens the detour taken by relayed traffic.
Compliance
A relay within your contractual and geographic perimeter.
Dedicated capacity
A reference sizing (design objective): 4 vCPU / 8 GiB / 5 Gbps for roughly 10,000 connections.
How it is deployed
- 1PrerequisitesA Linux server with a public IP and three open inbound ports (udp/443, udp/4433, tcp/443). There is no “outbound only” mode.
- 2Generate a tokenA one-shot fleet token in the console, private in scope, bound to your workspace.
- 3Write the minimal configToken, controller fingerprint, IP, capabilities — everything else comes down from the controller.
- 4First startThe register command consumes the token; the vigie receives its keys, its certificate and its allocations.
- 5External qualificationThe controller tests your three listeners from the outside before any allocation.
- 6VerifyGET /healthz, appearance in the console, your networks switch over to it.
Compared with fully self-hostable VPNs
In all honesty: some solutions (NetBird, ZeroTier, or Tailscale via Headscale) also let you self-host the control plane. VIGIL does not allow this today — the controller remains SaaS. In return, the relay is blind by construction and you can bring it back within your own perimeter. See /en/docs/comparatif.