| Cloudflare / Reverse Proxy |
Fully optional edge layer — Cloudflare, or a self-hosted reverse proxy (Caddy, nginx, Traefik). Islandr terminates TLS itself (dummy cert until an admin uploads one, hot-swapped at runtime) and can be reached directly with no proxy of any kind in front of it (ADR-0015). |
| DNS Upstream |
Fully optional — only reached when the resource DNS resolver is enabled in Settings. Public or admin-configured recursive resolver(s) (default 1.1.1.1 / 8.8.8.8, Settings.dnsResolverUpstream) the hub forwards any query outside its own managed resource zone to, verbatim and unparsed (ADR-0023). |
| Islandr |
Self-hosted WireGuard management platform. Peer lifecycle, RBAC access control, nftables enforcement. |
| Let's Encrypt (ACME CA) |
Fully optional — only contacted when an admin sets a domain and enables ACME in Settings. Islandr's own hand-rolled RFC 8555 client requests, validates (HTTP-01), and renews a certificate directly; no certificate library, no external ACME client (ADR-0019). |
| nftables |
Linux kernel packet filter. Enforces ACL rules generated by Islandr. |
| OIDC Provider |
Authenticates users. Microsoft 365 or Google Workspace. |
| Resource Host |
A machine behind the VPN inside a site (e.g. an RDP server). For browser-based RDP the hub connects to it directly over TLS and relays to the browser. |
| WireGuard |
Linux kernel VPN module. Managed via wg CLI. |