Yggdrasil - Encrypted IPv6 Mesh Network

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

Yggdrasil is a fully end to end encrypted IPv6 mesh network that removes the need for central VPN gateways, manual address planning or controller accounts. Unlike solutions that require a managed control plane or manual key distribution across nodes, this image delivers a self arranging overlay where every node derives a permanent cryptographic IPv6 address from its own key, and keeps that address regardless of NAT, changing IP addresses or which cloud it runs in.

This cloudimg image gives you a production ready Yggdrasil node running as a hardened systemd service within minutes of launch, removing the manual steps of compiling the binary, scripting key generation, authoring systemd units and applying security hardening.

Example use case: connect monitoring agents and microservices across multiple regions and an on premises data center without deploying a central VPN gateway. Each node keeps its stable IPv6 address as instances scale, migrate or change underlay networks, so service discovery configuration never breaks. A deployment spanning several clouds and a colocation facility needs only peering configuration between nodes, with no central controller to maintain.

How it compares: unlike Tailscale, there is no central coordination server or account required. Unlike raw WireGuard, there is no manual key exchange between every pair of nodes. Unlike ZeroTier, there is no controller to deploy, patch and keep highly available. You control peering access with your instance security group by allowing TCP port 9001 inbound only from your trusted peer addresses, and administer nodes over SSH with your existing EC2 key pair.

Security architecture: the image ships with no known credentials and no baked in key. On first boot a one shot service generates a unique node key for this instance alone, writes the configuration with strict permissions, and records the overlay IPv6 address, subnet and public key in a root only file. The admin socket is a local Unix domain socket, never network reachable. The only network facing surface besides SSH is a single TLS encrypted peering port on TCP 9001. Two instances launched from this image get different node keys, so no two instances ever share an overlay identity.

Application stack: the node runs the single yggdrasil binary (version 0.5.14) as a systemd service, administered with yggdrasilctl over a Unix domain socket. There is no database, no central controller and no external dependencies. Growth is simple: launch more instances or install the free Yggdrasil client on any machine and peer them together.

Getting started: launch this image with a security group allowing TCP 9001 from your peer addresses and SSH from your admin address, SSH in and read your node's overlay IPv6 address and public key from the credentials file, then add this node's endpoint to the Peers list on your other machines, or add remote endpoints to this node's configuration. Verify connectivity with yggdrasilctl to confirm the peer links are established and encrypted.

This is a repackaged open source software product with additional charges for cloudimg support services. Yggdrasil is distributed under the LGPL-3.0 license with a linking exception. cloudimg is not affiliated with or endorsed by the Yggdrasil Network project. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.