Architecture

You (device)                    Cloudflare                     Your mesh
┌──────────────┐           ┌──────────────────┐          ┌──────────────┐
│  jalth CLI  │──tRPC───▶│  Registry Worker  │──CF API─▶│  DNS records │
│              │           │  (D1 database)    │          │  Tunnels     │
│  WARP client │◀──WireGuard──▶ Cloudflare Edge ◀────────│  Access apps │
│  cloudflared │──tunnel──▶│  (330+ cities)    │          │  Gateway     │
└──────────────┘           └──────────────────┘          └──────────────┘

Components

CLI

Runs on your device. Orchestrates local setup (WARP enrollment, cloudflared tunnels) and talks to the Registry Worker. All management commands go through the Worker — no device-to-device dependency.

• Config: ~/.jalth/config.json
• Init only: Calls Cloudflare API directly (Worker doesn’t exist yet)
• Post-init: tRPC via @jalth/contracts

Registry Worker

A Cloudflare Worker in your account. Stores mesh state in D1 (devices, services, tokens, auth keys). Proxies Cloudflare API calls — devices never need your CF API token.

• Publicly accessible, authenticates via device tokens
• SSO devices: 90-day rolling inactivity expiry
• Auth-key devices: never expire

WARP

Cloudflare’s WireGuard VPN client. Every enrolled device gets a CGNAT IP (100.96.0.0/12). Traffic between devices relays through Cloudflare’s nearest PoP.

cloudflared

Outbound-only tunnel daemon. One persistent process per device, started lazily on first jalth serve. Handles service exposure and egress routing.

API paths

Path	Used by	Why
Release manifest	install.sh, upgrade	Versions, asset URLs, checksums
tRPC (@jalth/contracts)	All post-init commands	Worker proxies CF API
CF SDK	init only	Bootstrap before Worker exists

Always available

The Worker runs on Cloudflare’s global network. Your admin device being offline doesn’t prevent other devices from joining, exposing services, or checking status.