The private network the whole suite lives on — and it answers only to you.
What it is
OffScale is the network layer of the suite, run as its own thing: a coordination server you host, and a client on every device that joins the private mesh it hands out. Your phone and your server find each other through it wherever they happen to be — on home Wi-Fi, on mobile data, behind someone else’s router — and to everything else on the public internet the whole arrangement is simply not there.
It reimplements nothing
OffScale changes nothing about how your devices actually talk. The protocol on the wire is Tailscale’s, the encryption is WireGuard’s, and the coordination server is Headscale — the same open-source project, running untouched in a container on your own machine. A stock Tailscale client would speak to it without noticing the difference, and if you ever walked away from OffScale, Headscale would still be there, yours, running the same network.
Everything that carries your traffic or holds your keys is code that already existed, that other people wrote, and that anyone can read. We did not invent a mesh protocol or a control plane — inventing those and asking you to trust them is precisely the thing worth not doing.
What it adds is the running of it
Headscale on its own is a command line and a config file. It works, and it asks a lot: stand the server up, wire the certificate, mint pre-auth keys by hand, edit the access policy in an editor — and do all of it again for every network and every device. OffScale is that same thing, made to run.
It installs in one command: a bare machine becomes a working coordination server, certificate and all. It is managed from the app rather than a terminal — health, logs, restarts, and who may reach what. Adding a device is a link and a tap, with the key minted and handed over for you, never copied by hand. And it brings the parts Headscale leaves to you: enrolment, more than one network at once, and reaching a service on one network from another. The protocol stays theirs. The work of running it becomes ours.
It answers to you
The coordination server is yours, on your own machine, and it is the only thing that decides which device may reach which. No account with anyone, no company holding the keys to your network, and no third party that can be asked, breached or bought to hand over the map of your devices. The one that runs the mesh is the one you control.
The app
On the phone, OffScale is one screen. It opens on your network and connects — no sign-in, no account, nothing of ours to authenticate against. That independence is the point: everything else in the suite reaches you over this network, so a client that had to phone home before it would connect would be a knot that never unties. The app that gets you onto your network cannot itself need the network to be there.
It is dark, drawn on a photograph of dusk, and it does the one thing — without asking anything of you. Free, and source-available, like the rest of the suite.