Federation

One hub, many edges. Agents reach the union of all edges via iroh.

Hub↔edge control link

Edges hold a persistent TCP control link to the hub. The link carries:

• Route table (RouteSnapshot push on tenant/agent change).
• Hub signing pubkeys for local EdgeCred verification.
• Session events (SessionAdded / SessionRemoved) for agent_liveness.
• Iroh endpoint aggregation: POST /v1/bootstrap returns the union of all edges’ public iroh endpoints.

Matching PSKs on both ends:

openssl rand -hex 32 > hub.link.psk

# hub
-e TOWONEL_HUB_LINK_LISTEN_ADDR=0.0.0.0:51444
-e TOWONEL_HUB_LINK_PSK=$(cat hub.link.psk)

# each edge
-e TOWONEL_EDGE_HUB_LINK_ADDR=hub.example.eu:51444
-e TOWONEL_EDGE_HUB_LINK_PSK=$(cat hub.link.psk)

The link is plain TCP. Colocate hub and edges on a private overlay (WireGuard, Tailscale, VPC) or front it with stunnel/spiped.