jalth: personal mesh on your Cloudflare

Four ways to use it

Mesh devices. Expose services. SSH without keys. Control access from your IdP.

Mesh devices

Private network · zero firewall configuration

jalth init creates a mesh inside your Cloudflare Zero Trust account. Share the join URL. Devices show up on a CGNAT range and can talk to each other over WARP without opening any ports.

jalth join https://jalth.myteam.com

Public services

Expose anything · with CDN, WAF, DDoS

jalth serve creates a Cloudflare Tunnel, DNS record, Universal SSL certificate, and Access policy in one call. Gate the URL by email, identity-provider group, IP range, or country.

jalth serve grafana --port 3000 --allow group:devs

Zero-Trust SSH

SSH with short-lived certs from your IdP

jalth ssh issues a short-lived certificate from Cloudflare Access after your identity provider (Google, GitHub, Okta, or any OIDC) signs you in. No new SSH keys to distribute. Your existing authorized_keys keep working unless you remove them.

jalth ssh homeserver

Identity & access

Your IdP groups gate who can join, expose, and SSH

jalth group and jalth role reuse the Google, Okta, GitHub, or OIDC groups you already manage. Headless servers and CI runners enroll with scoped auth keys instead of browser SSO.

jalth role set alice@team.com operator

Built on Cloudflare Under the hood

A composition layer on top of Cloudflare's own products.

jalth doesn't replace anything. It wires the parts of Cloudflare you already pay for (or don't) into a coherent mesh, behind one CLI and one Worker.

WARP WireGuard-based device VPN. Encrypts traffic, assigns CGNAT IPs.

cloudflared Tunnels Outbound-only tunnels from each device to Cloudflare's edge. One per device.

Access Identity-aware reverse proxy. OIDC, SAML, and email OTP supported out of the box.

Access for Infrastructure Short-lived SSH certificates issued after SSO. Replaces key distribution.

Gateway DNS Per-device DNS overrides that resolve .mesh hostnames to CGNAT IPs.

DNS Public CNAME records for each exposed service. One record per jalth serve.

Workers + D1 Registry Worker holds mesh state and the only copy of your CF API token.

Universal SSL Automatic TLS certificates for every public service. Issued, renewed, and rotated by Cloudflare.

The architectural difference

What changes when the backbone is Cloudflare.

Mesh networking on Tailscale runs on Tailscale's coordination layer and tries hard to go peer-to-peer. Mesh networking on jalth runs on Cloudflare's edge, so device traffic relays through the closest Cloudflare POP, and every service you expose inherits CDN, WAF, and DDoS for free.

What stays the same

A private network across your devices, each on a stable CGNAT address.
One command to join from a new device, with browser SSO and no manual key exchange.
Identity-aware SSH using short-lived certificates from your IdP.
Public service exposure under your domain, gated by identity.

What changes

Device-to-device traffic always relays through the nearest Cloudflare POP. No direct WireGuard P2P.
The coordination plane is a Worker + D1 in your own Cloudflare account, not a third-party SaaS.
Every jalth serve sits behind Cloudflare's HTTP layer, so CDN, WAF, and DDoS come automatically.
The bill is whatever Cloudflare charges you, usually nothing for a personal mesh.

Need direct P2P latency, Taildrop, or first-class Windows today? Tailscale is the mature option. Pricing and limits on both sides change, so check Cloudflare and Tailscale before committing.

Pricing

Cloudflare's free tier does the heavy lifting.

jalth is a CLI and a Worker. Both live in your own Cloudflare account, and most of what they do fits inside Cloudflare's free tier: 50 Zero Trust seats, 1,000 tunnels, unmetered DDoS, and the rest of the numbers below. Verify the live limits on Cloudflare's pricing page and account limits before committing.

Resource	Cloudflare limit (today)	jalth usage
Zero Trust seats (Free)	50 humans	Headless devices use service tokens · don't count
Tunnels per account	1,000	One per device · created lazily on first `serve`
Access applications per account	500	One per exposed service
Mesh nodes per account	50	One per device on the WARP mesh
Workers requests (Free plan)	100,000 / day	~10–50 per device per day
CDN · WAF · DDoS	Included on Cloudflare's HTTP layer	Automatic on every `jalth serve`