Repository navigation
docs: Propose device access to Galactic VPC - #926
Closed
mattdjenkinson wants to merge 1 commit into
Closed
mattdjenkinson wants to merge 1 commit into
mattdjenkinson wants to merge 1 commit into
Conversation
Let a consumer's own devices (phones, laptops, CI runners) join a Galactic VPC over an authenticated tunnel and reach workloads on their private addresses. Today connectors only carry traffic from the edge to a service on a device; nothing lets a device reach into a network. Key points: - ConnectorAttachment grants a connector access to a network; the connector becomes a NetworkBinding consumer, so presence and readiness reuse the network-in-every-location machinery - A new VPC access gateway terminates device tunnels, authorizes the peer key and the user per session, bridges into the tenant VRF over SRv6 and advertises the device's address back through BGPAdvertisement - The tunnel protocol is the open decision: MASQUE CONNECT-IP over iroh (recommended, spike first) or WireGuard, behind the same API - Fixing datum-connect's peer authorization is a blocking prerequisite
Contributor
Author
|
Closed: device access to Galactic VPC already exists in datum-cloud/connect (managed gateways, per-device network bindings and CONNECT-IP over iroh), so this proposal duplicates shipped work. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consumers put workloads in a Galactic VPC to keep them off the public internet, but today the only way for an engineer's own phone, laptop or CI job to reach one is to expose it publicly first, and that only works for HTTP. This proposes letting those devices join a VPC directly over an authenticated tunnel, getting a private address inside it, with access granted per network through Datum IAM and revocable within seconds. It builds on the existing Connectors and Galactic MASQUE proposals, reuses the network-in-every-location binding model rather than adding a parallel one, and leaves exactly one decision open for the networking team: MASQUE CONNECT-IP over iroh (recommended after a short iOS spike) or WireGuard as the fallback. It also flags a peer-authorization gap in the current desktop connector client as a blocking prerequisite, and relates to the internal DNS proposal in #922.
Test plan