Security
End-to-end encryption
Section titled “End-to-end encryption”Every link in the system is encrypted:
- Node-to-node traffic flows over Tailscale VPN (WireGuard).
- Control-plane traffic (agent ↔ Meshive backend) is HTTPS.
- Pod isolation prevents clients from reaching the host OS — they get their own namespace with the permissions they need, and nothing more.
The result: a client renting a pod on your machine cannot see your filesystem, your other clients, or anything outside of their sandbox.
Clients can also opt to have their storage volumes encrypted at rest on your disks. The agent manages this entirely — no setup or action on your side — and the encryption key is never stored on your machine, so an encrypted volume’s contents are unreadable outside its normal use.
Minimal port surface
Section titled “Minimal port surface”Many platforms ask hosts to expose hundreds of ports. Meshive asks for four, full stop:
| Port | Purpose |
|---|---|
22/tcp | Host SSH (managed, monthly rotation) |
2222/tcp | Pod SSH proxy |
443/tcp | Agent ↔ control plane |
41641/udp | Tailscale VPN |
Everything else is firewalled at the agent. Less surface → less risk.
Credential hygiene
Section titled “Credential hygiene”- SSH and IPMI passwords rotate every month, automatically. New credentials always appear on the Host dashboard.
- Repeated failed login attempts trigger an automatic IP block.
- If you prefer key auth, register your own public key in the dashboard alongside the rotating password.
Hardware-change re-verification
Section titled “Hardware-change re-verification”Hardware reliability is the foundation of host trust, so any of the following changes automatically trigger a mini stress test (~30 minutes) before the machine returns to the pool:
- Motherboard change — the platform treats this as a full system rebuild, since every component has to be re-seated.
- GPU change — added, removed, or replaced. GPUs are tracked by their unique serial number, so swaps are detected even if the model is identical.
- CPU change — added, removed, or replaced.
You do not need to flag these changes manually; the agent notices on reboot and runs the test.
Routine health checks
Section titled “Routine health checks”In addition to the mini stress test above, every host runs:
- A disk and internet speed test once every 7 days, to catch slow degradation early.
If a routine check reports a problem, the dashboard surfaces it before it becomes a client-visible incident.