Nodes & the mesh
The gateway and workers
Section titled “The gateway and workers”The gateway is the one machine facing the internet. It runs the control plane, the console and API, and the edge that serves your routes. Every other node is a worker: it has no public ports at all, and everything reaches it over the mesh.
The mesh
Section titled “The mesh”Nodes are joined by a private WireGuard mesh. Each node gets a mesh address, and all traffic between nodes, and from the gateway to your services, travels over it encrypted. That is why a worker can run anywhere, a home server or another cloud, with nothing exposed.
What a node runs
Section titled “What a node runs”A node’s role decides what is scheduled on it:
- Workloads and builds: services, and image builds. The default.
- Workloads: services only.
- Builds: image builds only; services are kept off it.
- Mesh only: on the mesh, not in the cluster. Nothing is scheduled on it, and routes can reach its ports. A Mac or Windows machine joins this way.
The gateway is a build node too unless you turn Act as build node off.
A build runs privileged, so anyone who can deploy from Git can reach the machine it runs on. With one server the gateway has to build; once another node can, the overview suggests turning Act as build node off, so builds stay away from the machine holding the control plane and the database.
Adding a node
Section titled “Adding a node”Add node gives a one-line install command with a token in it. A registration token can be used again for many machines; a provisioning token works once. Mac and Windows machines have their own join scripts and join as mesh-only nodes.
A node that stops reporting is marked offline after a short while. After a few minutes more, the cluster moves its services to other nodes that can take them.
A Tailscale of your own
Section titled “A Tailscale of your own”Meshploy’s mesh runs on a Tailscale of its own: the service meshploy-tailscaled, on the interface meshploy0. A machine can keep its own Tailscale on tailscale0 beside it, installed before Meshploy or after, on its own tailnet, and the two do not touch each other’s routes, firewall or DNS. The tailscale command stays yours; Meshploy’s mesh answers to meshploy mesh, as in meshploy mesh status.
If your own Tailscale restarts, Meshploy’s mesh can pause for about a second while it puts its firewall rule back in front. A machine that joined before Meshploy had its own mesh stays on tailscale0.
Mac and Windows machines join with the ordinary Tailscale app.
- Gateway: The one machine facing the internet: the control plane, the console and API, and the edge. More
- Mesh address: A node’s address on the private WireGuard mesh, which all traffic between nodes uses. More
- Build node: A node that runs image builds. More
- Mesh-only: On the mesh but not in the cluster: nothing is scheduled on it, and routes can reach its ports. More
- Provisioning token: A join token that works once. A registration token can be used again. More