# Aral Mesh (VPN)

Each project has ONE mesh network (Tailscale-style). Devices are laptops or
phones running the NexGuard client, or the project's own Aral servers joined
with one click. Peers talk directly over WireGuard (NAT traversal) and fall
back to the relay `relay.aralcloud.uz:443` when a direct path is blocked. Every
device gets a stable mesh IP inside the project's `/24` (pool 100.96.0.0/12).

The old `aral vpn create/add-peer` server commands are retired: there are no
VPN servers any more, and the CLI has no mesh commands yet. Manage the mesh in
the console at `/console/vpn`, or through the client API below.

## Join a machine (console → Aral Mesh → "Add device")

The console mints a join token (`ngj_…`, valid 24 h) and prints the exact
Linux/macOS command to run on the device. That command embeds the token and
`NEXGUARD_API_HOST=aralcloud.uz`. A device that later starts the client WITHOUT
that variable — for example the desktop app — must have `aralcloud.uz` set as
the API host in the app's Settings.

Headless enrolment with a token, no account needed on the device:

    POST https://aralcloud.uz/api/mesh/enroll
    {"join_token":"ngj_…","name":"ci-runner","public_key":"<wg pubkey>",
     "os":"linux","client_version":"…","advertise_exit_node":false,"advertise_routes":[]}
    → {device_id, token, mesh_ip, network:{cidr,dns_suffix}, relays:[…]}

The returned `token` is the device token for `GET /api/mesh/netmap`,
`POST /api/mesh/endpoints`, `PATCH|DELETE /api/mesh/devices/{id}` (self).

## Join an Aral server (console → "Connect a server")

Pick a running server; the mesh client is installed inside the VM through the
guest agent, the server appears as a device with `server_id` set and comes
online within about a minute. Optional at connect time: share its internet as
an exit node, advertise IPv4 CIDRs (e.g. its private network). "Disconnect"
uninstalls the client and revokes the device.

## Approvals

Exit nodes and advertised routes are OFF until a project admin approves them
in the device row menu (Approve exit node / Approve routes). Approving an exit
node lets other devices route all their internet traffic through it.

## App sign-in

The NexGuard app signs in with a device code: it opens
`https://aralcloud.uz/console/vpn/link/<token>`; the signed-in console user
approves it there and the app receives its account token. Links live 15 minutes.