PharosVPN · v0 · pre-alpha · Apache-2.0
Personal VPN.
Enterprise VPN.
The same VPN.
A fleet of VPN nodes you own, driven by a controller that never exposes a port. Traffic crosses two of your nodes before the internet, enters on a rotating pool of addresses, and rides profiles the controller can't read. Watch it move — that's a live fleet up there.
- data plane
- port
- controller
- licence
§01 · the platform in one paragraph
PharosVPN is a self-hostable, open-source, dual-protocol (AmneziaWG + XRay / REALITY) VPN fleet platform. A private controller — — drives a fleet of dumb public VPN over outbound mTLS, exposes end-users through an optional , and serves them a mobile client — . One codebase, two postures: personal and enterprise.
four roles · one fleet
coxswain · node · relay · caravel
The controller stays hidden behind NAT and dials out to everything. Nodes are deliberately dumb. The relay is the only public ingress for clients.
§03 · three things the topology gives you
The crypto is the table stakes.
The topology does the work.
A typical VPN routes you through one box, on one address, with a profile its server can read. PharosVPN takes a different shape on all three — and the panels below run on a live fleet.
multi-hop cascade
No single node sees both ends.
A tunnel crosses two of your nodes before the internet: . You hold one key and only handshake with the entry; the exit is a dial the controller turns — server-side, live, no reconnect.
pick & switch
Switching exit is an instant route-flip on the entry — same profile, no re-handshake. Switching entry is the only move that re-establishes the tunnel.
split knowledge
One box that sees both who you are and where you go is the single point of correlation. Split the path across two nodes and it disappears.
yours, not Tor
Every hop is a node you run — full-throughput AmneziaWG, not a volunteer relay. Two hops by default, three max, gated on a computed MTU ≥ 1280.
multi-IP entry pool
Your fleet isn't one address.
Most VPNs have everyone dial the same vpn.example.com:443 —
a passive observer can cluster by employer without touching the crypto. Each node
binds a set of public IPs; the client picks one at random and
re-picks every interval ± jitter. The signature of "your VPN" becomes
a moving cloud.
end-to-end profile sync
The controller holds no usable secret.
Your profile — keys, nodes, the whole config — is sealed on your device. The controller stores it, signs it, and hands it to your other devices, but it cannot open it. Seize the controller and you get ciphertext and a signature, never a profile.
the controller · coxswain
An always-on controller that keeps the fleet correct.
The topology is the data plane. The control plane is — a single static binary that drives the fleet, reconciles drift on an interval, and surfaces what's happening in a self-hosted dashboard. The pillars above are pre-alpha; this part has shipped.
self-healing control plane
Provisioning a profile or device pushes to the affected nodes automatically. A reconcile sweep checks every node on an interval and re-applies config when one drifts or a data plane goes stale. Restart the controller and it re-reconciles the whole fleet.
monitoring & analytics
Live connect/disconnect events stream off each node over gRPC, with persisted session history. An in-process engine sweeps that history and raises alerts — leaked profile, impossible travel, off-hours, auth-failure spikes — with severity and evidence. Anomaly rules are best-effort and experimental.
tokens · audit · SIEM
A token-authenticated management API with scoped, expiring tokens. A hash-chained audit log of every action, so edits are detectable. A gRPC event stream for SIEM ingestion. SQLite by default; an optional pure-Go Postgres backend for scale.
“Dumb nodes. A compromised VPN node must not yield control of the fleet.”
— DESIGN.md, §1 goals
presets · not products
Same engine. Different defaults.
cox init --personal and
cox init --enterprise only swap defaults.
Nothing on this table is locked behind an edition.
pick a preset — both run the same binaries
the thirty-minute promise
Self-hostable in under thirty minutes.
Clone the repo, run cox init, point it at any cloud
VM you own. The controller stays on your laptop or a tiny private
box; only the VPN nodes live in public. No vendor account, no
lock-in beyond whichever cloud you happen to be paying.
pre-alpha · controller commands run today · expect rough edges
§07 · read the design
The architecture earns the trust.
Four trust boundaries, one CA, end-to-end-encrypted profiles, a controller that holds no usable user secrets. The design document is the single source of truth — every subproject defers to it.