Skip to content

February and March 2026: rebuilding on one design

The platform code moved into a fresh repository in late February, and March was spent making every hub the same: one design, BGP between regions, a second route reflector, and nColo as a self-service product. We also ran our own security review and fixed what it found.

Written up afterwards

Written in September 2026 from our session notes and commit history, and dated to the end of the period it covers. February and early March predate the session notes, so those entries come from the commit history alone.

What shipped

22 Feb: a fresh start for the code. The current platform code went into a new repository. It's the fourth generation of the platform, and everything since is tracked there.

4 Mar: one hub design. Every regional hub now runs from the same design instead of hand-built, one-off configuration. The original London hub was retired along the way. This is the change that makes adding a region routine instead of a project.

8 Mar: BGP between hubs. The mesh's routing moved to BGP, and hub-to-hub links moved onto direct public endpoints instead of a cloud transit layer. Ohio and Singapore were tested end to end the next day.

17 Mar: Frankfurt as a second route reflector. Route distribution had depended on a single point in London. Frankfurt now does the same job from another country, and we switched on traffic-flow visibility across the fleet at the same time.

19 Mar: nColo. Members could allocate a routed public IPv4 prefix, down to a single address, delivered to their tunnel with no NAT in the way, straight from a live pool.

Also in March:

  • A contact form, so reaching us no longer means hunting for an address.
  • The status page rewritten with a live hub map, and an echo service for testing reachability across the mesh.
  • Tier names settled as Basic, Plus and Pro.
  • Members can list their own hosted services in the directory, with live online/offline status.
  • Inactive accounts get a reminder before they're paused, and a one-click way back.
  • A new homepage built around an animated map of the network itself.
  • Download speed limits enforced. Until now only uploads had been limited, on every tier.

What broke, and what we fixed

  • Missing VPN configs. Members on the Ohio and Singapore hubs could see "no VPN configuration" after a tier change, because the lookup always asked London first. Fixed on 10 March.
  • Dropped return traffic. A firewall rule in the wrong position on the London hub dropped some legitimate return traffic. Reordered.
  • A near miss. A cleanup tool worked from a hard-coded list of regions and came close to flagging a live hub as an orphan to delete. Nothing was touched; the tool now reads live state instead.
  • Security review, 15–16 March. We reviewed the whole platform ourselves and fixed what we found within days: weaknesses in session handling, authentication and input handling, and some missing rate limits. We also tightened who can reach the hub routers' management interfaces.

By the numbers

91 changes to the platform repository in March, 1 in February (the initial import).