lolinet

Your machines on one encrypted network. On relays you own.

A self-hosted mesh network for vibe coding, built on EasyTier. Laptops, NAS boxes and dev servers join with one command and a pairing code, then reach each other directly or through your relays, whichever is faster.

Live network  ·  Self-hosting  ·  Reference  ·  Architecture  ·  Releases  ·  English · 简体中文

Is lolinet for you?

lolinet puts the computers you code on (a laptop, a NAS, cloud boxes, a server at home) on one private network, the way Tailscale does. The difference is that the relays, the keys and the console are all yours:

• Join with one line. curl <join site>/i | sudo sh -s <pairing code> installs the client, a background service and auto-upgrade. A code works once, for 15 minutes. The same line without a code installs or upgrades the client on a device that is already in.
• No shared network secret. Every device gets its own credential from your console. A credential lasts at most a year, can't be reused, and can be revoked on its own. A device's config holds no network secret.
• Built for cross-border links. Devices reach relays over WSS on port 443 with a TLS server name you choose. TCP rides inside KCP, so ISP shaping of long TCP flows doesn't slow it down. Traffic takes the lowest-latency path across a full mesh of relays.
• One small binary. lolinet has patched EasyTier built in. It installs the launchd or systemd service, shows which peers are direct and which are relayed, and upgrades itself only after checking the sha256 and test-running the new version.

It's for you if your machines sit on several networks (home, office, cloud, inside and outside mainland China) and you're willing to run a few small relays and one Cloudflare Worker. If you want a hosted service with nothing to run, use Tailscale or plain EasyTier.

Devices run macOS (Apple silicon and Intel) or Linux (x86_64 and arm64, with systemd). A relay is any Linux host with a public address.

See it live at join.edge.lo-li.co, the author's own network: open it in a browser for the public probe, or curl it for the install command.

Quick start

These three steps join a network that already exists. To set up your own network first, see Self-hosting.

1 · Get a pairing code. The person who runs the network creates one, either on the Pair page of the local console or from the terminal:

uv run scripts/pair.py new --name laptop --ip 10.188.16.11

2 · Join. On the device:

curl -fsSL https://join.edge.example.com/i | sudo sh -s XXXX-XXXX-XXXX

The script downloads lolinet from the latest GitHub Release (or the join site's dl/ if GitHub is unreachable or slow), checks its sha256 and test-runs it, then redeems the code, decrypts the config on the device, installs lolinet to /usr/local/bin, registers the launchd or systemd service, and turns on auto-upgrade (every 6 hours). It also installs the public probe, which reports only hardware and a rough location; pair with --no-probe to leave it out. Once a lolidesk release is published, it installs lolidesk too, without starting the host. On Linux it needs systemd. For Docker or a NAS without sudo, see devices without systemd.

Already in, or installed by an older script? Run it without a code. It uses the config already on the machine, installs or upgrades lolinet, and does nothing if it is current:

curl -fsSL https://join.edge.example.com/i | sudo sh       # install or upgrade
curl -fsSL https://join.edge.example.com/i | sh -s check   # only say whether it would, no root

3 · Check. Run lolinet. It shows the service, this machine, the days left on its credential, and every relay and device: direct or relayed, latency and loss.

Everything else is in the terminal too:

lolinet peers | routes                # easytier-cli peer / route
lolinet logs -f                       # kernel log, /var/log/lolinet/easytier.log
sudo lolinet restart
sudo lolinet upgrade                  # --check only looks, --dry-run downloads and verifies without switching
sudo lolinet up --auto-upgrade off    # turn auto-upgrade off (on turns it back on)
sudo lolinet down                     # stop and remove the service; config and binary stay
lolinet cli …                         # stock easytier-cli (lolinet core … is easytier-core)

How it fits together

The core is EasyTier with three small patches. Everything around it (the CLI, join site, pairing, console and public probe) was vibe coded with Claude.

device ──wss :443, your SNI──▶ relay ◀── tcp / udp, every pair ──▶ relay ◀──▶ relay …
  │                              ▲
  │                              └─ the issuer relay also runs the easytier-web console (overlay only)
  │
  └─ curl https://<join site>/i | sudo sh -s <pairing code>
       └─ join site on Cloudflare Workers:
            one-time encrypted configs (KV) · packages and upgrade manifest (R2) · public probe (Durable Object)

This is the beginning of the README. Read the rest at the original. Read the full README ↗