Device-held identity
Every device generates and retains its own key. Existing owner authority approves enrollment, rotation, removal, and recovery.
Open infrastructure from Daemonet · A Cordine Labs company
A network that answers
to the people using it.
Daemonet joins machines you control into private, cryptographically authorized profiles. Your devices create the identities, hold the keys, decide the policy, expose the services, and carry the direct traffic.
Self-hostable. AGPL-3.0. No managed account required.
DAEMONET PROFILE OWNER AUTHORITY
Your laptopdevice-held key
Tor-assisted discovery
direct WireGuard + origin HTTPS
Your serverserves the bytes
✓ coordination leaves the data path
Device identity Explicit policy No central proxy
YOUown identity authority
P2Pcarries ordinary traffic
TORassists private discovery
WG+transport plus app TLS
The open product
Identity, policy, naming, and routing live together.
A Daemonet profile is a user-owned authority graph, not a cloud tenant. Membership never silently opens an application: profile policy and a service’s own signed access policy both have to allow the connection.
Private names
Signed profile DNS maps stable names to authorized services and current routes. DNS describes authority; it never pretends to be transport.
Exact service gates
Lock an app to named members, portable entitlements, finite timed trials, or unlimited trial starts. A destination-issued pass is short-lived and bound to one device key.
Direct encrypted paths
Tor can introduce peers; WireGuard carries the private network; host-held HTTPS keys authenticate the application endpoint. Failure never invents an unapproved relay.
One private fabric
Use the machines you already own.
Attach a laptop, workstation, NAS, Raspberry Pi, home server, cloud VM, or cluster. Keep application custody at the endpoint while Daemonet supplies a consistent identity and route.
Remote work
SSH, Remmina, private dashboards, administration tools, and long-running sessions without exposing the origin as an anonymous public host.
Storage and media
Mount network drives, resume transfers, synchronize files, stream games, or reach a media library over the same owner-controlled profile.
Private applications
Publish internal HTTPS names, authorize exact users for exact periods, meter trials at the host, and revoke a device without changing the service identity.
When you want managed operations
1Man works for Daemonet.
It does not become your Daemonet.
1Man is Daemonet’s official managed operations and integration layer: enrollment coordination, verified names, certificate workflows, entitlements, availability operations, support, and explicit publication.
Non-negotiable boundaries
Convenience cannot rewrite authority.
Free and paid users receive the same privacy model. Managed infrastructure is allowed to know only what its explicit job requires, for only as long as that job requires it.
Devices are source of truth
No durable managed copy of the user’s topology can override current device state.
No operator impersonation
No password-account fallback lets Daemonet or 1Man approve a device or recover an identity.
No accidental data path
Coordination, DNS, and entitlements cannot silently become a content proxy, CDN, or relay.
Visible failure
Certificate, Tor, DNS, route, entitlement, or identity failure stops visibly instead of downgrading trust.
Portable systems
Stable service identity survives host replacement, and leaving 1Man does not destroy the underlying Daemonet.
Honest observation claims
Encryption protects content and integrity; it does not claim encrypted packet timing was literally unobserved.
Install, inspect, improve
Daemonet is an open product—not a signup form.
Start from source or a catered release. Managed access can be attached later without replacing the keys and profiles you create now.