Deploy a daemon

Every machine you connect runs one daemon, dedmeshd. It makes a single outbound connection to the Console and needs no inbound firewall rules, no root, and no special privileges.

The easiest path is the Console’s Connect a host wizard (on the Hosts page). It walks three steps:

1. Name the host. The Console mints a single-use join token for it.
2. Run the command it generates on the machine. The command embeds the join token and the Console’s CA fingerprint, so there is nothing to edit.
3. Verify: the wizard watches until the host enrolls and shows its connection transport and discovered containers.

The generated command comes in two flavors, shown below with placeholders so you know what you are running. Prefer copying the exact command from the wizard.

Option A: Docker

Works anywhere Docker (or a Podman compatibility socket) runs:

docker run -d --name dedmeshd-myhost --restart unless-stopped \
  --network host \
  --group-add "$(stat -c '%g' /var/run/docker.sock)" \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -v dedmesh-state-myhost:/state \
  -e DEDMESH_CONSOLE=console.dednets.com:9443 \
  -e DEDMESH_NAME=myhost \
  -e DEDMESH_JOIN_TOKEN=dn_... \
  -e DEDMESH_CA_FINGERPRINT=sha256:... \
  -e DEDMESH_DOCKER=inventory \
  registry.thenets.org/thenets/dedmesh-daemon

What the pieces mean:

• -v dedmesh-state-myhost:/state persists the host’s identity. The join token is spent on first connect; after that the daemon authenticates with a client certificate stored in this volume, so keep the volume across upgrades.
• DEDMESH_CA_FINGERPRINT pins the Console’s CA: the daemon downloads the CA certificate on first run and accepts it only if its SHA-256 matches.
• The read-only Docker socket lets the daemon list your running containers so you can publish them from the Console with one click. It is optional, and read-only in this flavor; containers labelled dedmesh.enable=false stay hidden.
• --network host lets the daemon reach services on the machine’s loopback and negotiate direct paths.

Option B: Linux server (systemd, no Docker)

For a bare Linux server, the wizard’s no-Docker variant installs a boot-started systemd service:

curl -fsSL https://console.dednets.com/install.sh | sudo sh -s -- --system \
  --console console.dednets.com:9443 \
  --name myhost \
  --token dn_... \
  --ca-fingerprint sha256:...

sudo is needed once, to write the system unit. The service itself runs as a dedicated unprivileged dedmesh user, starts at boot, and keeps everything (config, credentials, and a self-updatable copy of the binary) under /var/lib/dedmesh-myhost.

Option C: config file

If you build or download the binary yourself, a minimal TOML config replaces the environment variables:

console    = "console.dednets.com:9443"
name       = "myhost"
join_token = "dn_..."          # first run only
state_dir  = "dedmeshd-state"
ca_file    = "ca.pem"          # the Console CA, pinned

[[apps]]                       # optionally export a service right away
name = "nginx"
protocol = "http"              # http | tcp | udp
local_host = "127.0.0.1"
local_port = 8080
public = true                  # gets a public hostname, see the expose guide

Run it with dedmeshd -config myhost.toml, or let dedmeshd setup install it under systemd (Linux) or launchd (macOS) as your own user.

Verify

The wizard’s third step confirms enrollment automatically. Outside the wizard, the Hosts page shows the machine online with its connection transport, and the CLI agrees:

dedmeshctl daemons

Good to know

• Tokens are single-use. If a command fails before enrolling, generate a fresh command from the wizard.
• Updates are opt-in. Daemons do not update themselves unless you turn the rollout on; the Hosts page shows each host’s version and update state.
• Revoking a host (trash icon on its row) deletes it and everything it published; its certificate stops working on the next connection.