KEPOS

PRIVATE SERVICES / LOCAL ADDRESSES

Far away.Addressed locally.

Kepos makes services on another machine feel local—without a public IP, account, or virtual subnet.

The network was built wrong. It’s time to flatten the world.

  1. 01No public IP.
  2. 02No account.
  3. 03No virtual subnet.

01 / LOCAL SURFACE

The machine stays there.
The address arrives here.

The service stays where it is. Kepos brings its address to the loopback interface in front of you.

PRIVATE INDEX / HTTP
http://home.localhost:17480/

A private start page, delivered through the local gateway.

NAVIDROME / HTTP
http://navidrome.localhost:17480/

The music library is remote. Its address is local.

SSH / RAW TCP
$ ssh -p 2222 user@127.0.0.1

Raw TCP services bind to an explicit loopback port instead of a hostname.

02 / PRIVATE TOPOLOGY

Trust draws the topology.

One person opens a service. The people they trust become its private shape.

Trust forms a private topology Many trusted peers connect independently to one publisher. No peer-to-peer mesh exists between them. PUBLISHER TRUSTED_PEER_01 TRUSTED_PEER_02 TRUSTED_PEER_03 TRUSTED_PEER_04 ONE PUBLISHER / MANY TRUSTED PEERS
FIG. A — TRUST DRAWS THE BOUNDARYRelationship creates the private space.

03 / WHY KEPOS

A simpler network
by design.

Mesh VPNs connect devices into a virtual network. Kepos exposes selected services to the people trusted to enter.

01 / SCOPE

Services, not subnets.

The music, the shell, or the private web app—not another network to administer.

02 / TRUST

Trust stays with the person opening the service.

A local allowlist decides who may enter. No hosted account authority can add somebody in the middle.

03 / SPACE

Connection creates the private space.

Kepos does not provision an empty network first. The topology exists because the relationship exists.

04 / HOW IT WORKS

The mountain remains.
The detour doesn’t.

Discovery finds a peer. Local keys decide trust. One encrypted connection carries only selected services.

Kepos opens a clear route through a mountain A subscriber and publisher sit on opposite sides. An encrypted route passes through a tunnel cut into the mountain. PUBLIC DETOUR SUBSCRIBER PUBLISHER ENCRYPTED PATH NO PUBLIC ORIGIN
FIG. B — THE TUNNEL IS THE RELATIONSHIP BETWEEN TWO KEYS.
01

Discover

HyperDHT finds the pinned peer and attempts NAT traversal. Bootstrap nodes do not relay the stream.

02

Authenticate

The service owner accepts only public keys in a local allowlist. Private keys stay on their devices.

03

Open

One persistent encrypted connection carries independent channels for the selected services.

05 / TECHNICAL LINEAGE

Built from open
peer-to-peer primitives.

Kepos is an independent project built with technology from the Holepunch ecosystem.

01 / NETWORK

HyperDHT

Role — discovery, NAT traversal, and encrypted streams.

02 / CHANNELS

Protomux

Role — many selected services over one connection.

03 / RUNTIME

Bare

Role — a portable runtime layer across mobile and desktop.

Made possible by the people building these tools and the wider Holepunch ecosystem.

Kepos is independent and is not affiliated with or endorsed by Holepunch.

06 / OPEN SOURCE

Inspect the machinery.
Keep the relationship yours.

PUBLIC REPOSITORY tta-lab/kepos-neo READ THE SOURCE ↗
QUICK START FORTHCOMING

The first supported install path will be documented here when it is ready.