Your devices,
on one network
that nobody runs.

shrooms is a personal overlay mesh. Your laptop, phone, NAS and a VPS get addresses on a private IPv6 network and talk to each other directly over WireGuard — from a café, from mobile data, from another country.

No account. No coordination server. No company that can see your traffic, switch it off, or go out of business.

Install it Why it exists How it works

What it actually is

Three planes, deliberately separate, because they fail in different ways and conflating them is how a mesh becomes unexplainable:

The data plane

WireGuard, in userspace. Your traffic, encrypted end to end between your devices, taking the most direct path that works.

The rendezvous plane

Logos Delivery — a public gossip network — carries encrypted announcements so devices can find each other. It never carries your traffic.

The control plane

Who is a member, what they publish, what has been revoked. Signed, sealed to the mesh, and readable by nobody else.

Addresses are derived, not allocated: your address is a hash of your device key inside a prefix that is a hash of the mesh key. So there is no IPAM, no DHCP, no collisions, and nothing to coordinate — two devices that hold the same mesh key already agree on every address in it.

# what it looks like once it is running
shrooms status
network       fd3b:ffe9:f81::/48                       peers 4 (4 up)
self          laptop  fd3b:ffe9:f81:81a7:18bc:69b1:9bb:7e69

MESH     NAME         ANNOUNCE  TUNNEL  ENDPOINT
default  jimmy-crib   online    up 1m   192.168.0.152:51820
default  nothing      online    up 1m   relay:…@128.140.55.128:51820
default  vps (relay)  online    up 1m   128.140.55.128:51820
test     k11 (relay)  online    up 1m   192.168.0.125:51820

ssh k11.mesh          # names, not addresses
open http://immich.k11.mesh   # services, not port numbers

Why it exists

Tailscale is excellent and it is somebody else's coordination server. Every device you own asks a company where the others are, and that company can see the shape of your network, change the rules, be acquired, or simply stop. For a network made of your own machines, that is a strange dependency to accept.

Nebula removes the company and replaces it with lighthouses you run and a certificate authority you maintain by hand. Better, and still infrastructure — the thing most people install a mesh to stop having.

shrooms takes the third option: discovery over a public gossip network that nobody owns, so there is no server to run and no service to depend on. The fleet can be unreachable and your tunnels keep working — it is where devices find each other, not where they talk.

A phone is a full participant

Not a client of something else. The Android app runs the same Go core as the daemon, joins several meshes at once, and roams between wifi and mobile data without you touching it.

NAT is expected, not assumed away

Direct where it can, through a relay you run where it cannot, and it will ask your router for a port mapping so a home machine can be reached without you editing anything.

Membership can be withdrawn

Devices are admitted by an admin-signed credential that expires in thirty days and can be revoked. Losing a laptop costs that laptop, not the mesh.

Several meshes, one daemon

Your own devices on one; a mesh shared with friends on another. A separate identity, address and set of services on each, with nothing leaking between them.

A word about the daemon

The thing that runs on each of your machines is called the shrooms daemon, and that word is doing more work than it looks.

A daemon in the Unix sense was named at MIT in the sixties after Maxwell's demon — the imaginary being in a thermodynamics thought experiment who stands at a little door sorting molecules, tirelessly, for no reward. It stuck because that is exactly what a background process is: a patient attendant doing the sorting you would rather not think about.

But the older word underneath it is the Greek daimōn, and a daimōn is not a devil. It is an attendant spirit — an intelligence that goes with you. Socrates described a daimonion that never told him what to do and only ever warned him off a mistake. Not a master and not a servant. Something along for the trip.

Which makes the naming here almost embarrassingly literal. There is a mycelium under everything, quietly connecting things that look separate. Something fruits where the conditions are right. A helpful spirit sits with each of your machines and handles the sorting. Nobody is in charge and it works anyway.

The good trips are the ones where the thing in the background is on your side. So: no coordination server, no company in the path, nothing that phones home. Your daemon answers to you and to nobody else, which is the whole of the design and, as it happens, the correct set and setting.

It is also the practical difference from every mesh with a control plane somebody else runs. Those have a daemon too — it just does not work for you.

What it is not

It is a prototype in daily use by its author, and the documentation says exactly what is proven and what is merely written. Three things are worth knowing before you run it anywhere that matters:

It is not anonymity. Traffic is encrypted; a relay you route through sees your IP address, and the gossip network sees that something is publishing on a shard. It hides content, not the fact that you exist.
The network key is still a shared secret. Membership is a credential now, but that key derives the rendezvous topics and the announcement encryption, so leaking it exposes the control plane and means rotating for everybody.
Hole punching between two NATed peers is unproven. A reachable member — a VPS, or a home machine whose router grants a port mapping — is what makes the awkward cases work today.

SECURITY.md is the long version, including what leaks and what is deliberately deferred.