ManyTier

A Rust implementation of the ZeroTier V1 protocol, with a client and controller. ManyTier nodes can join ZeroTier networks, and official zerotier-one clients can join ManyTier networks. You can also host the roots and controllers yourself.

• Pure Rust: no C/C++ dependencies in the core crates
• Interoperable: both join directions plus mixed data-plane traffic are validated against official zerotier-one (1.14.x and 1.16.x)
• Self-hostable: run your own root ("moon") and network controller; generate, publish, and orbit signed moon files
• WASM-ready: the core crates compile to wasm32-unknown-unknown and WASI; all I/O is trait-abstracted

A free public ManyTier root and controller runs at manytier.manymath.com.

Status

V1 protocol (Salsa20/12 + Poly1305, C25519/Ed25519 identities, AES-GMAC-SIV) is implemented and tested for interoperability. The v1.9 tag records the V1 baseline. V2 (P-384/Kyber/ZSSP) is future work with no code beyond an empty, feature-gated placeholder module; it will not be built out until it's explicitly scoped. Not affiliated with or endorsed by ZeroTier, Inc.

Install

Source and CI candidates currently target Linux/macOS. The native service has no Windows TUN backend. Private Gitea candidate artifacts are not public download endpoints; public mirroring and releases are owner-operated. See release preparation.

Build from source using the pinned Rust 1.94.0 toolchain:

cargo build --release --locked
# the binary is `manytier`
./target/release/manytier --help

Or build the Docker image (no local Rust toolchain needed):

docker build -t manytier .
docker run -d --name manytier -v manytier-data:/data -p 9993:9993/udp manytier \
  service --data-dir /data --controller-mode
docker exec manytier manytier status

The image isn't published to a registry yet, so build it locally from the repo's Dockerfile for now.

Run a node:

# generate an identity and start the service (REST API on localhost:9993/tcp)
manytier service --data-dir ~/.manytier

# in another shell; token discovery reads authtoken.secret here
cd ~/.manytier
manytier status
manytier join <16-hex-network-id>
manytier listnetworks

Run your own controller and root:

# controller mode serves network configs for networks whose ID starts
# with this node's 10-hex address
manytier service --data-dir /var/lib/manytier --controller-mode

# generate a signed moon file others can orbit
manytier moon generate --identity /var/lib/manytier/identity.secret \
  --endpoint <public-ip>:9993

# clients: drop the .moon file into {data-dir}/moons.d/ or orbit at runtime
manytier orbit <moon-id>

Workspace layout

Crate	Purpose	WASM
manytier-crypto	Identity, Salsa20/12, Poly1305, C25519/Ed25519, AES-GMAC-SIV	yes
manytier-protocol	V1 wire format: packets, fragments, verbs, dictionaries, world files	yes
manytier-node	Node engine: peers, topology, VL2 Ethernet, controller logic; trait-abstracted I/O	yes
manytier-service	Native service: tokio UDP transport, TUN/TAP, SQLite controller DB, REST API	no
manytier-cli	The manytier binary	no
manytier-ffi	C ABI bindings (cdylib and staticlib)	no

packages/zerotier is the pure-Dart zerotier package: a client for the service HTTP API and FFI bindings for an embedded node. packages/zerotier_flutter is its Flutter plugin, which builds manytier-ffi with cargokit and bundles the library. The Flutter application in apps/ManyTier depends on both; run python3 tools/zerotier_dart_package.py stage before its first native build. See the zerotier and zerotier_flutter READMEs.

Testing

cargo fmt --all --check
cargo clippy --locked --all-targets --all-features -- -D warnings
cargo test --locked --all
python3 tests/shadow/test_cleanup.py
cargo check --locked --target wasm32-unknown-unknown -p manytier-crypto -p manytier-protocol -p manytier-node --no-default-features
cargo check --locked --target wasm32-wasip1 -p manytier-crypto -p manytier-protocol -p manytier-node --no-default-features

Protocol behavior is additionally validated in network simulation and against real official zerotier-one binaries: see tests/shadow/ for the Shadow simulation configs, the privileged interop lanes, and the evidence-bundle contract. .gitea/workflows/ owns private CI: main and maintenance branches run Rust validation, dependency auditing, target checks, the Linux Flutter application tests and the Dart package archive consumer. Tags and manual dispatch additionally run Docker checks and produce private candidate artifacts. Privileged interoperability remains a separate manual lane on its provisioned runner.

GitHub is an owner-managed public mirror. The future GitHub release workflow requires manual dispatch with an existing release tag; creating a draft release requires a separate explicit input. It is not exercised by private CI and tag pushes do not publish. No registry publication runs in these workflows.

License

MIT: see LICENSE. Files ported from ZeroTier One, listed in NOTICE, are under the Apache License 2.0: see LICENSE-APACHE.