The admin plane
The hub serves four doors, each with its own proof of identity, on separate listeners: a bug in one cannot expose another’s routes.
| door | who | proof | reachable from |
|---|---|---|---|
| the agents’ door | the agent on each server and twin | the agent’s signed requests | the private network; twins over the hub’s public HTTPS port, firewalled to their addresses |
| the admin plane: portal, API, MCP | people and coding agents, through vai, ownpaas or a browser | a device key paired once | inside a WireGuard tunnel only: nothing of it listens on a public address |
| the twin proxy | people and agents opening a twin | a grant: a link for named addresses and a time | the hub’s public HTTPS port, opened per grant |
| outbound only | the hub itself: the release channel, the licence | — | — |
Today: WireGuard Built
Section titled “Today: WireGuard ”vai carries a WireGuard tunnel inside its own process. The tunnel reaches the hub’s admin address and nothing else: no route to your servers. Inside it, the admin plane speaks TLS 1.3 with a certificate from the hub’s own certificate authority, which the device pinned at pairing, and every request is signed by the device. The firewall opens only WireGuard’s UDP port; WireGuard answers no packet it cannot authenticate.
On Hetzner, a lab gate checked that nothing of the admin plane answers on the hub’s public address (18 October 2026).
The browser: vai open runs a local proxy into the tunnel and opens the portal with a short-lived link signed by the device; the session cookie is bound to the device’s tunnel address and valid 12 hours.
Next: HTTPS with mutual TLS Planned
Section titled “Next: HTTPS with mutual TLS ”The proposal of 23 October 2026: the admin plane on the hub’s public TCP port 443, beside the agents’ door and the twin proxy, with mutual TLS required in the handshake (a client certificate per device) and the requests still signed. Port forwarding, vai open twin and SSH become HTTPS upgrades the hub authorises and audits, as kubectl port-forward does.
- Why: TCP/443 works on networks that block UDP; browsers and hosted coding agents can use the same door; the device’s transport key can be bound to hardware, which a WireGuard key cannot.
- The price: the admin plane becomes visible from the internet. A client without a device certificate is refused in the TLS handshake, before any HTTP is read.
- WireGuard stays an option (“private mode”) for teams that want no public admin port at all.
The lab spike passed; the build is scheduled after the rename.