ab/tsunagi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rename the --transport n0 value to relay and say what n0 means

Browse Source 
"n0" is Number 0, the company behind iroh, and the name leaked from iroh's
own preset into this project's user interface, where it explains nothing.
The value is now --transport relay, which says what it does; n0 stays as an
accepted alias.

Also spells out, in the CLI help, the README, the threat model and the
TransportPolicy docs, whose infrastructure is involved: address records are
published to and resolved from dns.iroh.link, and the fallback relays are
Number 0's, in the US, EU and Asia-Pacific.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
tsunagi
2026-09-21 12:17:01 +01:00
co-authored by Claude Opus 5
parent 5cc92d7067
commit fae62892e0
4 changed files with 35 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+10 -9
View File
@@ -100,8 +100,8 @@ wireguard: tsunkkcp43lmdje on fd15:1d9e:fa21:f201:…/64 mtu 1100, 1/1 tunnel(s)
Notes:
- Only one side needs `--peer`; the link is bidirectional.
- The default `--transport n0` uses iroh's public address lookup and relays, so
two machines behind NAT find each other. `--transport local` keeps everything
- The default `--transport relay` uses iroh's public address lookup and relays,
so two machines behind NAT find each other. `--transport local` keeps everything
on the local network. See *How peers find each other* below — it is worth
understanding what gets published.
- Without `CAP_NET_ADMIN`, add `--no-tun`: the mesh, the data links and the
@@ -184,10 +184,10 @@ explicitly.
Two different lookups are involved, and only one of them is this project's:
**1. Resolving one endpoint's address — iroh's, and it works today.**
With `--transport n0` or `--transport direct`, iroh publishes a signed record
of this endpoint's addresses, keyed by its endpoint id, to Number 0's public
service (`dns.iroh.link`, over pkarr and DNS) and resolves other endpoints the
same way. That is why `--peer <endpoint-id>` works with no address attached:
With `--transport relay` or `--transport direct`, iroh publishes a signed
record of this endpoint's addresses, keyed by its endpoint id, to the public
service run by Number 0 — "n0", the company behind iroh — at `dns.iroh.link`,
over pkarr and DNS, and resolves other endpoints the same way. That is why `--peer <endpoint-id>` works with no address attached:
iroh looks it up. None of that code is ours.
**2. Finding who is in a network — ours, and it is still manual.**
@@ -200,12 +200,13 @@ whatever those agents reach.
What this means in practice:
- With `n0` or `direct`, **your endpoint id and IP addresses are published to a
public third-party service.** They are not secret, and the network secret is
- With `relay` or `direct`, **your endpoint id and IP addresses are published
to a public third-party service** (Number 0's, unless you change it). They are not secret, and the network secret is
never published, but an observer of that service learns that your endpoint
exists and where it is. `--transport local` publishes nothing.
- A relay, when one is needed, sees the volume and timing of your traffic — not
its contents.
its contents. The default relays are Number 0's, in the US, EU and
Asia-Pacific.
## Storage