Mesh & Access
We take your servers off the public internet and give your team a way in that does not depend on a shared password.
Included
- A private mesh across your hosts on WireGuard, with its own control plane rather than a vendor's
- SSH closed to the internet, reachable only over the mesh
- Per-person access with named keys, so revoking someone takes one command
- Internal services published to the team without exposing them publicly
- Host firewall rules generated from the same source as the mesh, so the two cannot drift apart
- A documented recovery path for the day the mesh itself is the thing that broke
How the work runs
We map what is currently reachable from the internet — usually more than expected, because a firewall rule outlived the reason for it.
Then we build the mesh, move access onto it host by host, and close the public surface behind us. The order matters: nothing gets closed until the replacement path is proven to work from where your team actually sits.
The recovery path is written down before we need it, not after. A mesh that locks you out of your own servers is worse than the open port it replaced.
What we need from you
Root on the hosts, a list of who needs access to what, and the location of any existing VPN or bastion so we can retire it rather than leave it running.
Where this does not apply
If your servers are already behind a cloud provider’s private network and access runs through their identity system, adding a mesh mostly adds something else to operate.
What this draws on
These areas of the catalogue are covered by the package, or alongside it.