Rendezvous Service

lattice rendezvous run provides epoch-scoped WAN discovery as a separate stateless process and identity from relay/AutoNAT, mailbox, object storage, and trusted vault replicas.

The packaged configuration is private: a non-empty allowed_peer_ids list lets only those authenticated Lattice daemon Peer IDs connect. To operate a public instance, omit allowed_peer_ids or set it to an empty list. Public mode accepts connections from any authenticated libp2p Peer ID; the registration, discovery, and connection limits described below still apply.

Generate configuration

lattice rendezvous init --host rendezvous.example.net --print-firewall

init writes a validated config to the default service path, creates the stable identity under lock, and prints the client [network] entry. Use --allowed-peer <peer-id> (repeatable) for private mode, --external-ip for a raw address, and --out/--state-dir to place the config and identity explicitly. The installer and containers wrap this; see Self-Hosting the Edge Services.

Start from packaging/lattice-rendezvous.toml. Replace the external DNS names and either replace the example allowed_peer_ids entry for private operation or remove the field for public operation, then validate and inspect the stable service identity:

lattice rendezvous config-check --config ./lattice-rendezvous.toml
lattice rendezvous peer-id

The default service listens on TCP and QUIC port 4201. Registration TTL is restricted to 60-7200 seconds, active registrations are capped globally and per peer, discovery responses are capped, namespace-less enumeration is rejected, and each signed peer record is limited to 32 addresses and 16 KiB. Discovery responses contain at most eight records. Cookies are bound to the requesting Peer ID and namespace, cookie history is bounded, and renewals cancel prior expiry timers. TCP connection setup must complete within five seconds, and the client keeps a pagination cookie long enough to traverse its full 256-peer discovery window before starting a fresh discovery cycle.

In private mode, only allowlisted authenticated Peer IDs can establish service connections. In public mode, opaque membership-derived rendezvous namespaces scope discovery but are not access-control secrets or an admission boundary. Keep host firewall restrictions as an additional handshake-level control where appropriate.

Configure clients with the pinned service identity:

[network]
rendezvous_nodes = [
  "/dns4/rendezvous.example.net/udp/4201/quic-v1/p2p/<rendezvous-peer-id>",
]

The private observability listener defaults to 127.0.0.1:9477 and exposes /healthz, /readyz, and /metrics. Metrics contain no Peer IDs, namespaces, or network addresses as labels.

Install the system unit only after reviewing the privileged commands in docs/guide/self-hosting.md. For rootless operation:

install -Dm0755 target/release/lattice ~/.local/bin/lattice
install -Dm0644 packaging/systemd/user/lattice-rendezvous.service \
  ~/.config/systemd/user/lattice-rendezvous.service
install -Dm0600 packaging/lattice-rendezvous.toml \
  ~/.config/lattice-rendezvous/config.toml
systemctl --user daemon-reload
systemctl --user enable --now lattice-rendezvous.service
curl --fail http://127.0.0.1:9477/readyz

Back up rendezvous-identity.key. Losing or rotating it changes the pinned service Peer ID and requires every client configuration to be updated. Active registrations and metrics intentionally reset on restart.