How it works

Five components, all written in Rust.

Service backend — the API server. Orchestration, scheduling, Let's Encrypt certificates, and the REST API the CLI talks to. It runs as a Unisrv service on Unisrv instances; self-hosting all the way down.

Prox — the edge load balancer. Terminates public TLS and routes to the right instance. The backend pushes config and certificates to it as services change.

Nodemanager — the microVM orchestrator on each node. Drives Firecracker, sets up networking (TAP devices, bridges, NAT), streams logs back, manages the VM lifecycle.

vmInit — a minimal init inside each microVM. Pulls the image and sets up the container environment using crun.

Routr — the proxy beside the nodemanager. It dials out to prox over QUIC, authenticating against a private PKI, and holds that mTLS connection open. Prox multiplexes requests down it and routr forwards them straight into the target VM's network. No application-layer inspection.

Networking

                         Internet
                            │
                            ▼
┌─────────────────────────────────────────────────────────┐
│  Prox (Edge)                                            │
│  Terminates public TLS                                  │
│  Routes by SNI / Host header                            │
└───────────────────────────┬─────────────────────────────┘
                            │
          mTLS over QUIC, dialled out by the node
                            │
                            ▼
┌─────────────────────────────────────────────────────────┐
│  Routr (Node)                                           │
│  Holds the tunnel open, routes into the VM              │
└───────────────────────────┬─────────────────────────────┘
                            │
                   VM TAP interface
                            │
                            ▼
┌─────────────────────────────────────────────────────────┐
│  Instance (Firecracker microVM)                         │
│  Container receives plain HTTP                          │
└─────────────────────────────────────────────────────────┘

Traffic reaches the container unmodified. Prox and routr handle all TLS, so the app sees plain HTTP, and the private PKI means only authorized prox nodes can route into instances.

The node dials out and never accepts a connection. Nothing needs port forwarding, no inbound firewall rule is required, and a node behind shared NAT works the same as one with a public IP. That is what makes self-hosted nodes work, wherever they sit relative to ingress.