Documentation · juist

Basics

How juist works: The ideas the other pages build on, in plain words, from the network and its devices to freshness.
Install: Install juist from its package repository or a release on Debian, Ubuntu, Fedora or FreeBSD, check the download, or build the package from source.
Your first network: Create a network on one device, invite a second one, and check that the two reach each other.
Inviting devices: Add a device to the network with a code or a link, compare the four words, and give it a role as it joins.
Android: Install juist's Android app, join a network with a phone by its QR code or code, reach the devices by name, and see from the phone how each one is reached.

Use cases

Your own services, through the tunnel: Reach your mail server, Nextcloud or Git server under its usual name through the tunnel, while the rest of the internet keeps reaching it as before.
Share from your laptop: Put a file, a directory or the web server you are working on onto the internet in one command, under your laptop's own name, as you would with ngrok or cloudflared.
A homelab on the internet: Make a service on your NAS or home server reachable from the internet by name, behind CGNAT or DS-Lite, without forwarding a port on your router.
Tools for members alone: Run a wiki, a dashboard or another internal tool under a real name with a real certificate that only members of your network can open.
Your home LAN from anywhere: Reach the printer, the router's web interface or the cameras at home from anywhere, although they run no juist, through one member at home.
Safe on public Wi-Fi: In a café, a hotel or on a train, send your internet traffic and DNS through your own VPS or your connection at home, so the Wi-Fi sees only encrypted traffic.
Servers without open SSH: Close port 22 to the internet and reach your servers by ssh through the tunnel, by name, from the devices you allow.
From locked-down networks: Reach your network from a hotel, company or school network that lets nothing out but HTTPS, through a relay on port 443 and, where there is one, the company's proxy.
A game server for friends: Run a game server at home and let friends play on it under a name of yours, without opening a port on your router, through an ingress or straight through the tunnel.
An app in a container: Make an app in Docker or Podman a device of its own in your network, through a juist container that shares its network namespace, with its own addresses and its own place in the access policy.

Everyday use

Status and devices: See whether a device is connected, what needs attention, which devices are in the network, and every change made to it.
Managing without sudo: Name the local user who manages a device, so that juist commands run without sudo.
Names: Reach devices by name instead of address, and have public names lead to a member through the tunnel.
Removing a device: Take a device out of the network on every device, and know how soon each one drops it.
Updating juist: Install a new release on every device, and move the network to a new schema once all of them run it.

Admins and networks

Several admins: Add admins and admin keys, set how many must approve a change, and approve the changes that wait for you.
Several networks: Put one device in several networks at the same time, and tell juist which one a command is for.
Renaming and renumbering: Give the network or a device another name, move the devices' IPv4 addresses, or end the network, on all devices at the same time.
Access policy: Decide which devices may connect to which and on what ports, which exit nodes and subnets each may use, and keep the rest of the network apart.
Keys: Give a device new keys, start a device over, deal with a lost device, back up admin keys, and know what cannot be undone.

Routing traffic

Exit nodes: Send a device's internet traffic through another member of the network, and let a member carry it for the others.
Subnet routers: Reach the LAN behind one member, such as a printer at home, from every device in the network.
Multicast: Programs that find each other by multicast on a LAN, such as printers, media servers and LAN games, find the members of your network the same way.
Relays and ports: Give the network a relay for devices that cannot reach each other, open the right ports, and run without public helpers.
HTTPS only: Reach your network from a hotel, company or school network that lets nothing out but HTTPS, through your relays on port 443, and through a proxy if there is one.
Publishing services: Make a service on one of your devices, such as a NAS at home, reachable from the internet by name.
Service members: Publish a server you do not trust inside your network, through a separate juistd that no device accepts connections from.
Members-only names: A published name with a real certificate that only members of the network can open.
TCP services: Publish a game server or another service without TLS on its own port of every ingress.
Sharing: Share a file, a directory or a local web server on the internet right away, under the device's own name.

Design

Architecture: How juist is built, layer by layer, in what sense it is zero trust, and what it takes from WireGuard and Tailscale.
Compared with others: How juist differs from other mesh VPNs, with a central server and without one, and when one of them fits better.
Security: What juist trusts and what it does not, where the keys live, and which weaknesses it accepts on purpose.
Quality assurance: How juist checks agent-written code, what the tests establish, and where the evidence stops.

Help

Troubleshooting: What juist health says when something is wrong, what it means, and the command that fixes it.
Commands: Every juist command with its arguments and options, as its own help gives them.