NETWORK ARCHITECTURE

Identity first. Relationship second. Transport underneath everything.

The network defaults to unreachable. A peer generates identity locally, establishes consent through friendship, discovers a path, then exposes only the application capability or service explicitly chosen.

1

Identity

A keypair and persistent role address generated on the endpoint.

→
2

Relationship

A mutual friend handshake creates the first authorization boundary.

→
3

Discovery

DHT announce and lookup find current endpoints without changing identity.

→
4

Transport

Direct UDP first, TCP relay when needed, optional Express for offline delivery.

→
5

Application

Messages, files, agent tasks, names, or private service packets.

PEER → DECENTLAN

From a friend network to a general application network

The original Peer layer was already enough for social applications: identities, friendship, presence, messages, files, and offline delivery. DecentLAN keeps that trust model and adds an IP data plane, so software written for the existing internet becomes reachable through the same relationships.

01

Carrier friend network

Public-key identity, DHT discovery, mutual friendship, online presence, messages, groups, files, and Express offline delivery for social and communication applications.

02

@decentnetwork/peer

A pure TypeScript runtime that exposes the deployed friend network to Node.js applications, agents, scripts, and services.

03

Dora naming

A normal Peer maps durable userids to human names and private 10.86.x.x addresses without becoming a central account authority.

04

DecentLAN data plane

TUN routing carries standard TCP and UDP packets. Existing software reaches a friend’s machine by private address without learning the Peer wire protocol.

The ecosystem becomes much larger when existing software can participate

Developers no longer need to rebuild every application as a native Decent client. Install AgentNet at the network edge, then keep the application protocol you already use.

SSH & remote administration

Private maintenance paths without exposing port 22.

Websites & development servers

Publish a home-hosted site through a domain gateway and DecentLAN address.

Remote-team LAN

Internal dashboards, source services, databases, and agent boxes on one friend-scoped network.

HTTP APIs & agent gateways

Reach OpenClaw, model servers, webhooks, and local tools behind NAT.

RDP, media & files

Carry existing interactive and content protocols through private addressing.

IoT & custom TCP/UDP

Connect devices and legacy services without rewriting their network stack.

The public URL does not have to be where the application runs

A small public gateway can own DNS and TLS while the expensive, stateful workload stays on private hardware. DecentLAN is the addressable path between them.

RUNNING DEPLOYMENT · BTC.FI.CHAT

Local AI trading system, public dashboard

The BTC trading system runs its collectors, agents, Redis state, JSONL/SQLite history, dashboard, and local model integration on owned hardware. Caddy is an approved Peer friend and exposes only btc.fi.chat; the rest of the DecentLAN member at 10.86.205.11 remains friend-gated.

01public visitor→
02btc.fi.chat · Caddy→
03friend-authorized route→
0410.86.205.11:8080
btc.fi.chat {
  log {
    output file /var/log/caddy/btc.fi.chat_access.log
    format json
  }
  reverse_proxy 100.76.64.101:8080 10.86.205.11:8080
}
PUBLISHER PATTERN · INTERVIEW.NETWORK

4090 media pipeline behind a normal subdomain

Translation, speech synthesis, voice conversion, source media, and publisher output stay with the 4090 host. A public subdomain reaches the publisher over its private overlay address, so large models and media do not have to move onto a generic cloud server.

01publisher subdomain→
02Caddy · public TLS→
03DecentLAN address→
044090 · models · media
*.interview.network
      ↓ public HTTPS
Caddy gateway
      ↓ DecentLAN 10.86.x.x
publisher-owned 4090 service

Infrastructure is optional and independently operable

Bootstrap

Introduces a new peer to the DHT.

Relay

Blindly forwards end-to-end encrypted live sessions when direct UDP fails.

Express

Stores encrypted payloads for optional offline delivery.

Dora

Provides names and private address allocation to AgentNet.

Regional exit

Offers an approved path for policy- or geography-specific traffic.

SCOPE

Honest limits

  • DHT participation and traffic timing expose metadata; this is not a metadata-free system.
  • Offline delivery depends on an Express node retention window.
  • Endpoint and key security remain the operator’s responsibility.
  • Delivery instrumentation and relay robustness are still maturing.
  • There is no token and none is required or planned in the current phase.