| Cloudflare / Reverse Proxy |
Fully optional edge layer — Cloudflare, or a self-hosted reverse proxy (Caddy, nginx, Traefik). Islandr terminates TLS itself (dummy cert until an admin uploads one, hot-swapped at runtime) and can be reached directly with no proxy of any kind in front of it (ADR-0015). |
| Islandr |
Self-hosted WireGuard management platform. Peer lifecycle, RBAC access control, nftables enforcement. |
| nftables |
Linux kernel packet filter. Enforces ACL rules generated by Islandr. |
| OIDC Provider |
Authenticates users. Microsoft 365 or Google Workspace. |
| Resource Host |
A machine behind the VPN inside a site (e.g. an RDP server). For browser-based RDP the hub connects to it directly over TLS and relays to the browser. |
| WireGuard |
Linux kernel VPN module. Managed via wg CLI. |