Get started

Mesh

Each node owns mesh ~you. Inbound starts closed: empty allowlist, secret off. az mesh add puts a point on pending. That point runs az mesh accept before either side dials. A member can reach this node’s overlay address. az mesh secret is optional privacy — it does not change who is allowed.

az mesh add ~friend

az mesh accept ~owner

Default

A fresh node is not open. az mesh status looks like:

inbound=allowlist exit=off members=0 pending=0 meshes=0

Empty roster is still closed. Strangers fail fast: you are not on dest’s mesh. Last mesh remove does not re-open. secret=on only prints after you opt in.

Two directions

Who	Command	What
Dest	`az mesh add ~friend`	Invite. Friend lands in pending.
You	`az mesh accept ~owner`	Outbound join. Dest moves you pending → member. A member can reach this node.
Dest	`az mesh remove ~friend`	Revoke inbound.
You	`az mesh leave ~owner`	Drop outbound join.

Commands

Command	What
`az mesh status`	Inbound allowlist and roster
`az mesh add ~friend`	Add them to pending
`az mesh accept ~owner`	Join a dest-owned mesh (outbound). Dest promotes you to member
`az mesh remove ~friend`	Kick pending or member
`az mesh leave ~owner`	Leave a mesh you accepted
`az mesh open`	Public ping. Optional. Clears roster. Refuses while secret is on, or while the exit bit is on
`az mesh close`	Empty allowlist (back to default-closed)
`az mesh secret`	Optional. Hide pending/members from the public snapshot
`az mesh public`	Publish pending/members on the snapshot (default)

Open, close, secret

Three bits. Default is closed + public roster.

Open is public ping. Optional. SSH needs an accepted member. Refuses while secret is on (az mesh public first), and while this node’s exit bit is on. Turn that bit off on the Mesh tab in az, then open. The bit forwards public traffic for accepted members. Exit.

Close returns to an empty allowlist. That is the default.

Secret hides names from the public snapshot. Optional. Membership is still add, then accept. Refuses while inbound is open ping (az mesh close first). az mesh public turns it off. Secret dests can only add a point whose networking key is known.

Open and secret refuse each other.

How to send a file

Both of you install and log in. They add you:

az mesh add ~you

You accept, then print a Host stanza:

az mesh accept ~friend

az ssh config ~friend

Then scp to the Host name it prints. SCP.

A member can reach this node, including when secret is on.

Where vs whether

The dest-map answers where a ~name lives. Peers look you up so first contact can happen. That lookup is public.

Mesh answers whether they may talk to you. Dest is the door. The galaxy caches a dest-signed snapshot; it does not grant membership.

Public dests publish names on GET /mesh/{name} (for example https://nut.relay.azimov.network/mesh/sampel-palnet). Secret dests publish secret:true and empty name lists; members fetch a sealed mailbox instead.

See how it works and galaxy.

Grants

Today a member reaches the overlay address. Per-name grants are coming soon.