Run your own registry.

The registry (rendezvous) and beacon that coordinate the public backbone are open source under AGPL-3.0. Run your own and you hold the admin token, so the controls the public backbone keeps for its operators are yours: private networks, roles, identity-provider checks, network policy and audit export.

Build and run it rendezvous on GitHub Registry reference docs

License: AGPL-3.0; The code behind the public backbone’s registry and beacon.
Process: Registry + beacon; rendezvous runs both in one process. A standalone beacon is available too.
Admin: Your token; Creating networks and every registry-wide setting need it.
Support: None; No hosted option, support plan or SLA. You operate it.

Nobody runs registries for customers.

Vulture Labs runs the public backbone and nothing else. On the public backbone only its operators can create networks, because that takes the registry admin token. If you run your own registry, you build, secure, back up and upgrade it yourself, with no support plan or SLA.

Public backbone or your own

Same protocol, different operator.

Daemons speak the same protocol to either registry. What changes is who holds the admin token and who sees the registry’s metadata.

On each agent machine

Public backbone

Run by Vulture Labs

Admin token: its operators

$ pilotctl daemon start

Your registry

Run by you

Admin token: you

$ pilotctl daemon start --registry registry.example.com:9000 --beacon registry.example.com:9001

Register, trust peers, send messages
Anyone
Whoever can reach your registry
Create networks
Operators only (admin token)
You
Roles, identity provider, policy, audit export, blueprints
Operators only
You
Data service agents
Reachable
Not registered on your registry
Who sees registry metadata
Vulture Labs
You
Uptime, backups, upgrades
Vulture Labs
You

What’s in the registry

Controls in the open-source code.

All of these work on a registry you run. The reference docs cover each one in detail.

MembershipPrivate networksOpen, token or invite-only join rules; invite-only needs the network’s enterprise flag. Members reach each other without a separate trust handshake.

AdministrationOwner, admin, memberOwners promote and demote admins and can transfer ownership. Owners and admins invite and remove members. A per-network admin token delegates one network.

IdentityOIDC/JWT with JWKSTokens checked for issuer, audience and expiry. Other providers connect through an identity webhook you run, with HMAC-signed requests.

IdentityDirectory syncSet roles from a directory file, pre-assign roles to identities that haven’t joined, and with --remove-unlisted remove members who aren’t in it.

PolicyNetwork policyA membership cap and a port allowlist per network: joins over the cap are refused. Versioned expression policies add rules, with admin-assigned member tags as inputs.

EvidenceAudit exportRegistry changes are recorded as structured events and exported in Splunk HEC, CEF or JSON format.

EvidenceWebhooks with a DLQRegistry events go to your webhook with retries. Events that still fail land in a dead-letter queue you can read back.

ProvisioningBlueprintsOne JSON file describes a network. Apply it with pilotctl extras provision.

KeysRotation and expiryNodes rotate their keys with a signed request. You can set an expiry per node; a node whose key has expired is refused at heartbeat.

MembershipInvites with consentOn an invite-only network the invited node has to accept. Pending invites expire after 30 days.

OperationsHot standbyEvery change goes through a write-ahead log. A hot standby, authenticated with a replication token, replicates from the primary.

OperationsDashboardA live dashboard and the same public-stats JSON the public backbone publishes. Per-network figures need a dashboard token.

Build and run

From source to first network.

The build is plain Go with no cgo. Open TCP 9000 and UDP 9001 to your agents. Without -store, the registry keeps its state in memory only.

registry host · rendezvous

your firewall

agent machines

TCP :9000registry

open TCP 9000

UDP :9001beacon

open UDP 9001

127.0.0.1:3000dashboard

stays on the host

-storestate on disk

without it, memory only

pilot-daemon

Build and start the registry

One process serves the registry and the beacon. Keep the admin token secret: it can create and change every network.

ops@registry ~ rendezvousgo build

# on the registry host (Go, at the version in go.mod)
$ git clone https://github.com/pilot-protocol/rendezvous
$ cd rendezvous && go build ./cmd/rendezvous
# registry on TCP 9000, beacon on UDP 9001, dashboard on 3000
$ export PILOT_ADMIN_TOKEN="$(openssl rand -hex 32)"
$ ./rendezvous -registry-addr :9000 -beacon-addr :9001 \
    -store /var/lib/pilot/registry.json -http 127.0.0.1:3000

Point your daemons at it

A daemon talks to one registry at a time.

agent@node ~

# on each agent machine
$ pilotctl daemon start --registry registry.example.com:9000 \
    --beacon registry.example.com:9001

Create a network and join it

pilotctl info shows your node ID.

agent@node ~admin token

# create a network with the admin token, then join it
$ export PILOT_REGISTRY=registry.example.com:9000
$ pilotctl network create --name ops --join-rule token \
    --token "$JOIN_TOKEN" --node-id <your node id>
$ pilotctl network join <network id> --token "$JOIN_TOKEN"

Turn on the registry controls

Registry admin commands sit under pilotctl extras and read PILOT_REGISTRY and PILOT_ADMIN_TOKEN.

ops@registry ~ registry settingsadmin token

# OIDC/JWT: tokens checked against your JWKS
$ pilotctl extras idp set --type oidc \
    --url https://login.example.com/.well-known/jwks.json \
    --issuer https://login.example.com --client-id pilot
# audit export to Splunk (or --format syslog_cef | json)
$ pilotctl extras audit-export set --format splunk_hec \
    --endpoint https://splunk.example.com:8088/services/collector \
    --splunk-token "$HEC_TOKEN"
# a whole network from one file, and roles from your directory
$ pilotctl extras provision ops-blueprint.json
$ pilotctl extras directory-sync directory.json --network <id> --remove-unlisted

Blueprints

One file describes a network.

Join rule, policy, role pre-assignments, identity provider and audit export, applied with pilotctl extras provision. Applying the same blueprint again updates the network instead of making a second one.

ops-blueprint.jsonblueprint

{
  "name": "ops",
  "join_rule": "invite",
  "enterprise": true,
  "policy": { "max_members": 50, "allowed_ports": [1001, 1002] },
  "roles": [
    { "external_id": "alice@example.com", "role": "admin" }
  ],
  "identity_provider": {
    "type": "oidc",
    "url": "https://login.example.com/.well-known/jwks.json",
    "issuer": "https://login.example.com",
    "client_id": "pilot"
  },
  "audit_export": {
    "format": "splunk_hec",
    "endpoint": "https://splunk.example.com:8088/services/collector"
  }
}

$pilotctl extras provision ops-blueprint.json

find or create
enterprise
policy
identity provider
audit export
roles

network

ops invite-onlyenterprise

Invited nodes have to accept. Members reach each other without a separate handshake.

policy

membersmax 50ports1001 data exchange1002 event streamothers

identity provider

oidc · login.example.com · client pilot

Tokens checked for issuer, audience and expiry against the JWKS.

audit export

splunk_hec → splunk.example.com:8088

roles

alice@example.com →admin

Applied when a node with that identity joins.

Hardening

Stricter checks, off by default.

These flags are off by default so older clients keep working. On your own registry you can turn them on once every client you run supports them.

ops@registry ~ start with the flags you pick

$ ./rendezvous -registry-addr :9000 \
    -beacon-addr :9001 \
    -store /var/lib/pilot/registry.json \
    -http 127.0.0.1:3000

Flip a registry flag to add it to the command.

Registryrendezvous

Standalone beacon

-require-punch-tokenReleases a peer’s endpoint only for a punch token issued by that peer. A flag on pilot-protocol/beacon; the beacon built into rendezvous doesn’t expose it.

Daemon

PILOT_STRICT_DATAPLANE_TRUST=1A private node refuses key exchange and control traffic from peers it doesn’t trust.

Before you run it

Limits worth knowing.

The registry is the same small service that runs the public backbone. It wasn’t packaged for other operators.

01
Source, not a product
The rendezvous and beacon READMEs describe the repositories as published for transparency, not as a hosting guide. There is no installer; you build from source and follow the repository yourself.
02
One identity provider
The identity-provider setting is registry-wide. Setting a new provider replaces the previous one.
03
Finite buffers
The audit buffer holds the latest 1,000 events and the webhook dead-letter queue the latest 100. Export to a store you keep; failed webhooks are not replayed automatically.
04
Separate from the backbone
Nodes on your registry can’t reach the public backbone’s data service agents or its peers. A daemon talks to one registry at a time.
05
Security is yours
Keep the admin token secret: it can create and change every network. See security for what each component sees.
06
AGPL-3.0
If you modify the registry or beacon and let others use it over a network, the license requires you to offer them your source.

Reference

Each control in detail.

The reference docs describe the commands and fields for each control on a registry you run.

rendezvous on GitHub beacon Install the daemon