Run your own
registry.
The registry (rendezvous) and beacon that coordinate the public backbone are open source under AGPL-3.0. Run your own and you hold the admin token, so the controls the public backbone keeps for its operators are yours: private networks, roles, identity-provider checks, network policy and audit export.
Nobody runs registries for customers. Vulture Labs runs the public backbone and nothing else. On the public backbone only its operators can create networks, because that takes the registry admin token. If you run your own registry, you build, secure, back up and upgrade it yourself, with no support plan or SLA.
rendezvous runs both in one process. A standalone beacon is available too.Same protocol,
different operator.
Daemons speak the same protocol to either registry. What changes is who holds the admin token and who sees the registry’s metadata.
Anyone
Whoever can reach your registry
Operators only (admin token)
You
Operators only
You
Reachable
Not registered on your registry
Vulture Labs
You
Vulture Labs
You
Controls in the
open-source code.
All of these work on a registry you run. The reference docs cover each one in detail.
Private networks
Networks with open, token or invite-only join rules; invite-only needs the network’s enterprise flag. Members of a network can reach each other without a separate trust handshake.
AdministrationOwner, admin, member
Owners promote and demote admins and can transfer ownership. Owners and admins invite and remove members. An optional per-network admin token delegates one network without the global token.
IdentityOIDC/JWT with JWKS
RS256 and HS256 tokens checked for issuer, audience and expiry. Keys are fetched from your JWKS URL by key ID and cached for five minutes. Other providers connect through an identity webhook you run, with HMAC-signed requests.
IdentityDirectory sync
Push a directory file to set the roles of listed members, pre-assign roles to identities that haven’t joined yet, and, with --remove-unlisted, remove members who aren’t in it.
Network policy
A membership cap and a port allowlist per network: joins over the cap are refused and daemons drop traffic to unlisted ports. Versioned expression policies add rules, with admin-assigned member tags as inputs.
EvidenceAudit export
Registry changes are recorded as structured events in a 1,000-entry, hash-chained buffer, and can be exported in Splunk HEC, CEF or JSON format, with three tries and exponential backoff.
EvidenceWebhooks with a DLQ
Registry events go to your webhook with retries. The last 100 events that still failed are kept in a dead-letter queue you can read back.
ProvisioningBlueprints
One JSON file describes a network: join rule, policy, role pre-assignments, identity provider, webhooks and audit export. Apply it with pilotctl extras provision.
Rotation and expiry
Nodes rotate their keys with a signed request. You can set an expiry per node; a node whose key has expired is refused at heartbeat.
MembershipInvites with consent
On an invite-only network the invited node has to accept. Pending invites expire after 30 days.
OperationsHot standby
Every change goes through a write-ahead log. A hot standby (-standby, authenticated with -repl-token) replicates from the primary.
Dashboard
-http serves a live dashboard and the same public-stats JSON the public backbone publishes. Per-network figures need -dashboard-token.
From source
to first network.
The build is plain Go with no cgo. Open TCP 9000 and UDP 9001 to your agents. Without -store, the registry keeps its state in memory only.
# on the registry host (Go, at the version in go.mod) $ git clone https://github.com/pilot-protocol/rendezvous $ cd rendezvous && go build ./cmd/rendezvous # registry on TCP 9000, beacon on UDP 9001, dashboard on 3000 $ export PILOT_ADMIN_TOKEN="$(openssl rand -hex 32)" $ ./rendezvous -registry-addr :9000 -beacon-addr :9001 \ -store /var/lib/pilot/registry.json -http 127.0.0.1:3000 # on each agent machine $ pilotctl daemon start --registry registry.example.com:9000 \ --beacon registry.example.com:9001 # create a network with the admin token, then join it $ export PILOT_REGISTRY=registry.example.com:9000 $ pilotctl network create --name ops --join-rule token \ --token "$JOIN_TOKEN" --node-id <your node id> $ pilotctl network join <network id> --token "$JOIN_TOKEN"
# OIDC/JWT: tokens checked against your JWKS $ pilotctl extras idp set --type oidc \ --url https://login.example.com/.well-known/jwks.json \ --issuer https://login.example.com --client-id pilot # audit export to Splunk (or --format syslog_cef | json) $ pilotctl extras audit-export set --format splunk_hec \ --endpoint https://splunk.example.com:8088/services/collector \ --splunk-token "$HEC_TOKEN" # a whole network from one file, and roles from your directory $ pilotctl extras provision ops-blueprint.json $ pilotctl extras directory-sync directory.json --network <id> --remove-unlisted
{
"name": "ops",
"join_rule": "invite",
"enterprise": true,
"policy": { "max_members": 50, "allowed_ports": [1001, 1002] },
"roles": [
{ "external_id": "[email protected]", "role": "admin" }
],
"identity_provider": {
"type": "oidc",
"url": "https://login.example.com/.well-known/jwks.json",
"issuer": "https://login.example.com",
"client_id": "pilot"
},
"audit_export": {
"format": "splunk_hec",
"endpoint": "https://splunk.example.com:8088/services/collector"
}
}Registry admin commands sit under pilotctl extras and read PILOT_REGISTRY and PILOT_ADMIN_TOKEN. pilotctl info shows your node ID. Port 1001 is the data-exchange service send-message uses; 1002 is the event stream.
Stricter checks,
off by default.
These flags are off by default so older clients keep working. On your own registry you can turn them on once every client you run supports them.
-strict-directory-authRegistry
Requires trust or a shared network before lookups, resolves, punch requests and listings return a node.
-strict-registration-authRegistry
Requires a proof-of-possession signature on registrations that submit a public key.
-strict-heartbeat-freshnessRegistry
Binds a timestamp into signed heartbeats so a captured heartbeat can’t be replayed.
-strict-expiry-bindingRegistry
Binds the requested expiry into the key-expiry signature.
-tlsRegistry
TLS for registry connections, with your certificate (-tls-cert, -tls-key) or a self-signed one generated at start.
-require-punch-tokenStandalone beacon
Releases a peer’s endpoint only for a punch token issued by that peer. A flag on pilot-protocol/beacon; the beacon built into rendezvous doesn’t expose it.
PILOT_STRICT_DATAPLANE_TRUST=1Daemon
A private node refuses key exchange and control traffic from peers it doesn’t trust.
Limits worth
knowing.
The registry is the same small service that runs the public backbone. It wasn’t packaged for other operators.
The rendezvous and beacon READMEs describe the repositories as published for transparency, not as a hosting guide. There is no installer; you build from source and follow the repository yourself.
The identity-provider setting is registry-wide. Setting a new provider replaces the previous one.
The audit buffer holds the latest 1,000 events and the webhook dead-letter queue the latest 100. Export to a store you keep; failed webhooks are not replayed automatically.
Nodes on your registry can’t reach the public backbone’s data service agents or its peers. A daemon talks to one registry at a time.
Keep the admin token secret: it can create and change every network. See security for what each component sees.
If you modify the registry or beacon and let others use it over a network, the license requires you to offer them your source.
Each control
in detail.
The reference docs describe the commands and fields for each control on a registry you run.