Skip to content
MangoFly

  • MangoFly

    A self-hosted WireGuard mesh. Devices connect straight to each other; the coordination server is one binary and a SQLite file, and never sees their traffic.

    ExploreDocsPricing
    encrypted WireGuard · peer to peerLaptopbehind home NATServerin a datacentrePhoneon mobile datacoordination serverone binary · one SQLite filecontrol plane only (TLS)keys · tunnel addresses · peer lists · sealed ICE candidatesholds no private keys · carries no traffic · cannot decryptdatacontrol

  • MangoDock

    Docker management with nothing on the hosts. Reaches each daemon over an ordinary SSH session — no agent to install, no port to open.

    ExploreDocsPricing
    The MangoDock dashboard showing three host cards with container state counts, CPU and memory gauges, a usage history and recent events

  • MangoWiFi

    A Wi-Fi 6/7/8 test bench. One binary runs as Console or Agent either side of the access point under test, measuring latency under real load.

    ExploreDocsPricing
    AP under testWi-Fi 6 / 6E / 7Agentstation side · real radioLAN receiveriperf3 -sConsoleUI · orchestrates · probes
  • Blog

  • Nothing phones home

    No telemetry, no analytics, no crash reporter, no account login. Check it with a packet capture on your own network.

    Download MangoSSH
  • Project
  • Download

    • Operating it

    Configuration as a file, metrics, backups, and headless machines.

    The audit log records who changed what, from which address.

    Configuration as a file

    Networks, Resources, access policies, DNS, the device-login setting and the mesh range, as one document. Everything is matched by name rather than by id, so a file written by hand works as well as one that was exported, and an exported document applies back as a no-op — the property that makes it safe to keep in git.

    mangofly-server --export-config --out config.json
mangofly-server --apply-config config.json --dry-run
mangofly-server --apply-config config.json

    Deliberately not in it: anything secret (setup keys, tokens, passwords, licences), devices and their routing-peer assignments, and users and groups. A section the file leaves out is left alone; --prune deletes what the file does not name.

    Metrics, audit and backups

    • Metrics — Prometheus format: devices total and online, peers, relay sessions, policy counts and the server's own health.
    • Audit log — Every administrative change, with who did it and from where. Changes made from the CLI are recorded with the actor cli.
    • Backups — The whole state is one SQLite file plus the licence beside it, and it can be copied while the server runs.

    Take a backup before every upgrade. Migrations run on startup and are not reversible — once a newer server has opened the database, the older image will not start on it. The backup is the only way back.

    Headless machines

    For a server, a VM or a container, the daemon is the whole client with no window. The server address and setup key are needed on the first start only; after that the identity lives in the state directory. Every flag has an environment variable, which is usually what you want in a unit file.

    mangoflyd --server https://mesh.example.com --setup-key KEY --name buildbox

    --accept-routes defaults off here, unlike the desktop app where it defaults on: a server should not route its own traffic through a peer by accident.

    ← The mesh's address rangeFree & Pro →