A self-hosted control plane for small fleets. Nodes dial out, never in. Firewall, DNS, WireGuard, proxy-core and subscriptions all move through the same review gate — and the approval hashes what you were actually shown.
Architecture
The server is the only component that holds state. Nodes run an agent that opens outbound connections and leases work. Plugins extend the server, but they are verified before they load and hold no durable storage of their own.
First install
The recommended start is a server on 127.0.0.1:8088 behind a reverse proxy, TOTP on the first admin, and one node-agent enrolled with host mutation still switched off. Execution is opt-in per node, so an enrolled agent that nobody has authorised can report but cannot change anything.
State lives in a bind-mounted directory: the image carries none of it. Back up state.json, the hot store, the audit WAL and master.key together — losing the key makes stored credentials unrecoverable.
$ git clone https://github.com/LatticeNet/lattice.git
$ cd lattice/compose
$ cp .env.example .env
$ $EDITOR .env
$ mkdir -p data plugins
$ docker compose up -dThe bootstrap admin password is printed once, to the container log.
Control loop
Firewall rules, DNS records, WireGuard topology, proxy-core deployment and agent updates all travel the same path. Only one stage stops for a human, and it is the same stage every time.
Intent is set in the dashboard or through the API.
serverThe server builds a review plan with secrets stripped.
serverThe dashboard sends the SHA-256 of the plan actually shown.
serverThe agent leases a bounded task over outbound HTTPS.
nodeThe node validates artifacts before it mutates anything.
nodeResult and actor trail land in the server log.
serverStatus
Lattice is early. It is usable for private fleets with a hardened perimeter, and it is honest about the parts that are not finished — those sit in the same table as the parts that are.
| Component | State | Version | What it does |
|---|---|---|---|
| lattice-server | prerelease | alpha-0.2.2a6 | The control plane. Holds all state; serves the dashboard. |
| lattice-agent | stable | v0.3.3 | The host binary. Dials out, leases tasks, applies and reports. |
| lattice-sdk | stable | v0.2.18 | Shared models and the plugin protocol. Versioned contract. |
| @latticenet/plugin-bridge | prerelease | v0.1.0-alpha.1 | The sandboxed postMessage channel a plugin UI uses to reach its own backend. |
| Sub-Storelatticenet.sub-store | live | 0.5.0-alpha.1 | A native subscription platform: store, fetch, process, publish. |
| VPN Corelatticenet.vpn-core | live | 0.8.0-alpha.7 | VLESS + REALITY profiles, lines, users, and usage reporting. |
| NetGuardlatticenet.netguard | live | 0.1.0-alpha.9 | Reviewed firewall zones, groups and bindings with an adopt path. |
| WireGuardlatticenet.wireguard | live | 0.1.0-alpha.9 | WireGuard topology and device peers, planned before applied. |
| Arbitrary community plugin execution | not enabled | — | The bounded runner is for trusted system plugins. Running unreviewed third-party code against host capabilities is not a switch that is off — it is a design that is not finished. |
| Remote marketplace install | not enabled | — | The plugin index is a read-only draft catalogue. Installing from it is a separate trust decision that still belongs to the operator, by hand. |
Plugin trust
The capability list lives inside the signed payload. A plugin cannot quietly ask for more privilege than it was signed for, because asking for more changes the signature.
Runtime binaries and the UI are built on a pinned toolchain. A different Go or Node version produces different bytes.
A deterministic packer writes the archive. Packing twice must produce identical bytes, and CI rebuilds it to check.
The publisher signs the manifest, which covers the artifact digest, the capability list and the interfaces.
The server hashes the artifact it actually has and compares it to the manifest. A swapped artifact fails here.
enforced by your serverThe signature is verified against the operator-held trust file. An unknown publisher is refused, not warned about.
enforced by your serverCapabilities are granted from the verified manifest. Host-risk capabilities require a signature — that default is fail-closed.
enforced by your serverWhere to start
Install the server, enrol agents, enable TOTP, back up state, and switch on host mutation only where you actually need it.
Operator guideSecurity reviewersTrust boundaries, approval hashing, capability gates, probe resistance on the public subscription route, and why an agent never needs an inbound port.
Security modelDevelopersSplit-repo layout, versioned SDK contracts, the release tag order that downstream artifacts depend on, and how to author and sign a plugin.
Developer guide