Whalenet
Inspect and govern the fleet you already run, where every member holds a routable address anyone can verify.
In this chapter
- Nodes, Names and TagsA fleet member is minted through the control plane, with what it is called derived from the address it holds.
- Inspect Your FleetRead what the shell reports about this machine, its peers, the round trip to one of them, who holds an address.
- The Access DocumentOne HuJSON file per fleet decides which of your own principals may reach which targets, on which ports.
- East-West ReachabilityWhat decides whether one of your agents may open a connection to another, before any packet is sent.
- Approval and HoldsDecide whether a new member reaches its siblings, admit it deliberately, or unbind one that is already live.
- Serve and FunnelPut a local port in front of the fleet, or in front of the internet, over a leaf certificate pinned in DNS.
- Whalenet DNS RecordsWhat a fleet publishes in its own subtree, how to read a name through the resolver in effect, the verbs that write.
- SSH Between NodesOpen a shell on a fleet member with its host key proven from the IANA DNSSEC root before the session is trusted.
- Managed SettingsWhat an MDM can pin on a machine so the client arrives pointed at the right control plane with the right key file.
- Plan a MigrationRead an existing mesh with credentials that cannot write, then study the file that enumerates every change it describes.
Whalenet Documentation
Whalenet is the mesh between the machines and agents you already run: servers, containers and autonomous agents, each holding a globally routable IPv6 /128 from 2a04:2a01::/32 announced by AS219419. One command shell reads the whole fleet, and one document decides which member may reach which.
whisper whale status
That prints this node's identity and connection, then every peer in the fleet. Without a key the node half still answers.
Every member is minted through the control plane rather than configured on the machine, and what it is called follows from the address it draws. That derivation, the short label you can set beside it, and the tags a grant later matches on are covered in nodes, names and tags.
Reading comes before writing. Inspect your fleet covers the status screen, a measured round trip to one peer, and the keyless lookup that says who holds any address on the internet. Whalenet DNS records covers the resolver profile in effect on a host and the records your fleet publishes in its own subtree.
Governing is one file. The access document is its grammar, its grants and the tests block that has to pass before a write lands. East-west reachability is the order in which a connection between two of your own members is decided, and approval and holds is how a new member is admitted to its siblings, or a live one unbound.
Putting a local port in front of an audience, whether that is the fleet or the internet, is serve and funnel. SSH between nodes opens a shell with the host key proven from the IANA DNSSEC root. Managed settings is what an MDM pins on a machine so the client arrives ready, and plan a migration reads a mesh you already run into a file you can study before anything changes.