encrypted, authenticated pipes between two endpoints using a pre shared key
spiped is a secure pipe daemon. It creates a symmetrically encrypted and authenticated tunnel between two socket addresses, so a service that speaks no encryption of its own can still be reached safely across an untrusted network. One side accepts plaintext connections and encrypts them, the other side decrypts and hands the stream to the real service, and both ends hold the same pre shared key. Because the key is required to complete the handshake at all, a client without it is dropped before it ever reaches the protected service, which makes the tunnel a credential gate as well as an encrypted channel.
cloudimg ships spiped secure by default. Nothing usable is baked into the image: the pre shared key is generated on first boot from the kernel random source, so no two instances hold the same key material, and both daemons are held behind a bootstrap gate until that has happened. Both ends of the pipe ship configured and running, so the encrypted round trip is provable on the instance itself before you wire in a second endpoint, and the plaintext side is bound to loopback so the protected service is never exposed in the clear. The daemons run unprivileged under systemd and the pipe is retargeted from a single configuration file rather than by editing unit files. Every deployment is fully patched, with a paired deploy guide and 24/7 cloudimg support.