Skip to content

Getting started

Quick start

This walkthrough assumes you have installed jalth and WARP on at least two devices.

1. Create the mesh

Section titled “1. Create the mesh”

On your admin device, run:

Terminal window
jalth init

The CLI prompts for your Cloudflare API token, deploys the Registry Worker, configures Zero Trust, and enrolls this device. With a custom domain:

Terminal window
jalth init --domain myteam.com

When complete, share the join URL:

jalth join https://jalth.myteam.com

2. Add a member

Section titled “2. Add a member”

Before anyone can join, add their email to the mesh:

Terminal window
jalth role set sarah@team.com member

3. Join from another device

Section titled “3. Join from another device”

On the second device:

Terminal window
jalth join https://jalth.myteam.com

Browser SSO completes enrollment. The device gets a CGNAT IP and a .mesh hostname.

4. Verify connectivity

Section titled “4. Verify connectivity”
Terminal window
jalth status
jalth ping sarah-laptop

5. Expose a service (optional)

Section titled “5. Expose a service (optional)”

Requires a mesh domain (jalth init --domain or jalth domain set):

Terminal window
jalth serve demo --port 3000 --allow group:devs

Without a domain, use a throwaway quick tunnel:

Terminal window
jalth serve demo --port 3000 --quick

What you built

Section titled “What you built”

Registry Worker

Mesh state in D1. Proxies Cloudflare API calls — devices never hold your API token.

jalth.myteam.workers.dev

WARP mesh

WireGuard-encrypted device-to-device traffic via Cloudflare’s edge.

100.96.0.0/12 CGNAT range

Gateway DNS

Device names resolve on every enrolled device automatically.

homeserver.mesh → 100.96.0.2

Access control

Three layers: mesh membership, management roles, per-service policies.

jalth role · jalth serve —allow

Next steps

Section titled “Next steps”