Greasewood

A minimal, self-hosted, greasy WireGuard mesh network.

Its one priority is being easy to reason about. It was built by someone who lovingly maintained a fleet of hand-written WireGuard/networkd text files far past the point of practicality, and wanted the simplest possible upgrade.

• Private. Membership is gated by a certificate authority; revoke a node by not renewing it.
• Direct-or-fail. No routing, no relays. A link comes up directly or it honestly fails.
• IPv6 only overlay. The overlay is IPv6-only; the underlay may be IPv4 or IPv6.
• Linux-only. Leans heavily on systemd, nftables.
• Greasy. Uses the stock wg/ip tools over subprocess.
• Named. Every node gets a <host>.<mesh>.internal name and matching TLS certs from the same CA.
• Policy-derived topology. Roles + an allow-only grant table control who talks to whom.
• Self-certifying addresses. A node's IPv6 address is a hash of its identity key.
• Service TLS. The same CA issues auto-renewing x509 certs for your services (Postgres, nginx, …).
• Offline-tolerant. The anchor can be down for a credential lifetime, nodes run from cache.
• Hands-off. Never automatically configures your main firewall. Port access control lives on a dedicated table.
• Auditable. Pure Python, one dependency. Fanatical logging.
• Self-contained. The coordination anchor is just a normal node. Any node can become the anchor.

Start here

• Install — pipx, distro packages, or the bundled installer.
• Quickstart — bootstrap an anchor, enroll a node, watch it link.
• Live dashboard — gw watch, the colored mesh view.
• Access control — roles, grants, host grants, declarative assignments.

Prior art

The nearest full-featured projects are Tailscale, Nebula, and innernet. Next to greasewood they're all bigger systems that do more: routing, NAT traversal, multi-platform, etc. Greasewood aims to be a minimal alternative.