Polari — Apps

VPN & Links Mesh & Radio Isle Network Guests Bridges & Integrations

VPN & Links 1WireGuard-based isle links and their placements.

Vpn vpn polari-app
Isle VPN (vpn-1): the isle-vpn app family (Isle Link = WireGuard-based, Isle Bridge = OpenVPN-based, ten kinds, Blind / Sees-traffic on every row) — Polari MIRRORS each isle's VPN app state (networks, peers with public keys only, access rules, federation links, .vpn exposures; POST /api/islemesh/ingest/vpn) and PROPOSES changes an operator applies on the isle (VpnProposal inbox; D9 authority is isle-side). Engine renders Link confs / nftables text; Bridge refuses until step-ca. Feeds /display/vpn and the .vpn column of /display/isle-mesh.
VPN & Links — wireguard, vpn app payload 209.5 KB · 2 libraries (18.4 MB measured) · needs modules: islemeshengines: cryptography (python 14.9 MB) — system engines come from the distro or offline media, never inside an app deb steps on download: analyze shared payload → package module files → write manifest → assemble deb → stream to you
Install — runs hereThe app itself, for host / hardware members.READY — generated 741 min ago, past its hold — kept while there is room (requested 1×, downloaded 0×) · 58.1 KB · download usually <1 sDownload
Access only — the shellOpens the app hosted on your isle; installs nothing else. For any member, even Access only.READY — generated 741 min ago, past its hold — kept while there is room (requested 1×, downloaded 0×) · 2.4 KB · download usually <1 sDownload
DEV Dev variantOffered on dev-posture instances only (this one is in production posture). The same app with security observing — warns, never denies; for testing on your own isle.

Mesh & Radio 1Reticulum and other transports that need no internet.

Reticulum reticulum hardware-extension-app
Reticulum mesh transport (ret-1, RETICULUM_TRANSPORT_PLAN): identities/destinations/interfaces/bindings as rows, per-PATH link measurements, ledgered airtime budgets, .arch archipelago with GRADED trust, parent+child state replication, operator-licence assertions + device links. RNS stack lives ONLY in the pol-reticulum sidecar, pinned rns==0.9.4+lxmf==0.6.3 (RETICULUM_LICENCE_GATE.md — pins are licence pins). THE LINE (ret-8): nothing arriving over Reticulum mutates Polari state. Third module born manifest-first on dyn-1.
Mesh & Radio · Network Devices — reticulum, lora, meshExpansion of isle-relay — its install refuses unless isle-relay is installed first.a hardware extension: only its Polari side (data, pages, simulations) runs here — a Docker Swarm deployment cannot reach the OS kernel or devices. The hardware half needs a full isle with the 'hardware' agent tier (the app route: installed from the deb, with the KVM guest and passthrough the hardware map assigns). Fine for development; not a working device here. app payload 293.2 KB · 1 library (3.5 MB measured) · needs modules: islemesh steps on download: analyze shared payload → package module files → write manifest → assemble deb → stream to you
Install — runs hereThe app itself, for host / hardware members.READY — generated 741 min ago, past its hold — kept while there is room (requested 1×, downloaded 0×) · 86.5 KB · download usually <1 sDownload
Access only — the shellOpens the app hosted on your isle; installs nothing else. For any member, even Access only.READY — generated 1969 min ago, past its hold — kept while there is room (requested 1×, downloaded 1×) · 2.4 KB · download usually <1 sDownload
DEV Dev variantOffered on dev-posture instances only (this one is in production posture). The same app with security observing — warns, never denies; for testing on your own isle.

Isle Network Guests 3OpenWrt guests the isle runs: relay and guest networks.

Isle Guestnet isle_guestnet hardware-app
isle-guestnet: an OpenWrt guest (hardware app) serving guest-only WiFi, isolated from the isle; exposures as rows.
Isle Network Guests · Network Devices — openwrt, guest wifiHardware app — its install refuses before installing anything on a lightweight (docker-swarm) isle or a member without the hardware tier, and says why.a hardware app: only its Polari side (data, pages, simulations) runs here — a Docker Swarm deployment cannot reach the OS kernel or devices. The hardware half needs a full isle with the 'hardware' agent tier (the app route: installed from the deb, with the KVM guest and passthrough the hardware map assigns). Fine for development; not a working device here. app payload 16.2 KB · 1 library (3.5 MB measured) · needs modules: hardwareapps, islemesh steps on download: analyze shared payload → package module files → write manifest → assemble deb → stream to you
Install — runs hereThe app itself, for host / hardware members.READY — generated 741 min ago, past its hold — kept while there is room (requested 1×, downloaded 0×) · 7.1 KB · download usually <1 sDownload
Access only — the shellOpens the app hosted on your isle; installs nothing else. For any member, even Access only.READY — generated 741 min ago, past its hold — kept while there is room (requested 1×, downloaded 0×) · 2.4 KB · download usually <1 sDownload
DEV Dev variantOffered on dev-posture instances only (this one is in production posture). The same app with security observing — warns, never denies; for testing on your own isle.
Isle Relay isle_relay hardware-app
isle-relay: a second OpenWrt guest (hardware app) serving a relay segment that extends the isle; the body for the Reticulum extension app (WiFi over Reticulum).
Isle Network Guests · Network Devices — openwrt, relay, wifiHardware app — its install refuses before installing anything on a lightweight (docker-swarm) isle or a member without the hardware tier, and says why.a hardware app: only its Polari side (data, pages, simulations) runs here — a Docker Swarm deployment cannot reach the OS kernel or devices. The hardware half needs a full isle with the 'hardware' agent tier (the app route: installed from the deb, with the KVM guest and passthrough the hardware map assigns). Fine for development; not a working device here. app payload 14.3 KB · 1 library (3.5 MB measured) · needs modules: hardwareapps, islemesh steps on download: analyze shared payload → package module files → write manifest → assemble deb → stream to you
Install — runs hereThe app itself, for host / hardware members.READY — generated 741 min ago, past its hold — kept while there is room (requested 1×, downloaded 0×) · 7.0 KB · download usually <1 sDownload
Access only — the shellOpens the app hosted on your isle; installs nothing else. For any member, even Access only.READY — generated 741 min ago, past its hold — kept while there is room (requested 1×, downloaded 0×) · 2.4 KB · download usually <1 sDownload
DEV Dev variantOffered on dev-posture instances only (this one is in production posture). The same app with security observing — warns, never denies; for testing on your own isle.
Islemesh islemesh polari-app
isle-mesh convergence (mac-1): the polari-side acceptor for isle-mesh data — devices/uplinks/mesh-apps/protocol-permits ingested from the isle agent's registry.json + nginx fragments (isle stays authoritative over networking); mock ingests carry mock_network=true, surfaced as a banner. Feeds /display/isle-mesh and the mac-10 console.
Platform & Operations · Isle Network Guests — isle, mesh app payload 171.7 KB · no extra libraries · needs modules: appstore, odooconnect, vpnengines: docker (system — not on this server) — system engines come from the distro or offline media, never inside an app deb steps on download: analyze shared payload → package module files → write manifest → assemble deb → stream to you
Install — runs hereThe app itself, for host / hardware members.READY — generated 980 min ago, past its hold — kept while there is room (requested 1×, downloaded 1×) · 48.3 KB · download usually <1 sDownload
Access only — the shellOpens the app hosted on your isle; installs nothing else. For any member, even Access only.READY — generated 1673 min ago, past its hold — kept while there is room (requested 1×, downloaded 1×) · 2.4 KB · download usually <1 sDownload
DEV Dev variantOffered on dev-posture instances only (this one is in production posture). The same app with security observing — warns, never denies; for testing on your own isle.

Bridges & Integrations 3MQTT, gRPC and other doors into and out of Polari.

Grpcbridge grpcbridge polari-app
gRPC contracts from stabilized schemas, Java hardware bridges, hw sim rigs.
Bridges & Integrations — grpc, java app payload 1.6 MB · 4 libraries (18.1 MB measured, 1 unmeasured here)engines: grpcio (python 16.2 MB) — system engines come from the distro or offline media, never inside an app deb steps on download: analyze shared payload → package module files → write manifest → assemble deb → stream to you
Install — runs hereThe app itself, for host / hardware members.READY — generated 741 min ago, past its hold — kept while there is room (requested 1×, downloaded 0×) · 530.0 KB · download usually <1 sDownload
Access only — the shellOpens the app hosted on your isle; installs nothing else. For any member, even Access only.READY — generated 1673 min ago, past its hold — kept while there is room (requested 1×, downloaded 1×) · 2.4 KB · download usually <1 sDownload
DEV Dev variantOffered on dev-posture instances only (this one is in production posture). The same app with security observing — warns, never denies; for testing on your own isle.
Mqttbridge mqttbridge polari-app
MQTT bridge: brokers + topic->object bindings as rows, explicit connect, ingest with refusal ledger; publish knob OFF at mqtt-1. paho-mqtt==2.1.0 (EDL-1.0 edge).
Bridges & Integrations — mqtt app payload 32.8 KB · 1 library (0 B measured, 1 unmeasured here) steps on download: analyze shared payload → package module files → write manifest → assemble deb → stream to you
Install — runs hereThe app itself, for host / hardware members.READY — generated 741 min ago, past its hold — kept while there is room (requested 1×, downloaded 0×) · 10.6 KB · download usually <1 sDownload
Access only — the shellOpens the app hosted on your isle; installs nothing else. For any member, even Access only.READY — generated 741 min ago, past its hold — kept while there is room (requested 1×, downloaded 0×) · 2.4 KB · download usually <1 sDownload
DEV Dev variantOffered on dev-posture instances only (this one is in production posture). The same app with security observing — warns, never denies; for testing on your own isle.
Odooconnect odooconnect polari-app
Odoo ERP connector: JSON-RPC client with sim/ops write guards, instance configs, /api/odoo status.
Business & Work · Bridges & Integrations — odoo, erp app payload 137.2 KB · no extra libraries · needs modules: bizops, supplychain steps on download: analyze shared payload → package module files → write manifest → assemble deb → stream to you
Install — runs hereThe app itself, for host / hardware members.READY — generated 741 min ago, past its hold — kept while there is room (requested 1×, downloaded 0×) · 35.8 KB · download usually <1 sDownload
Access only — the shellOpens the app hosted on your isle; installs nothing else. For any member, even Access only.READY — generated 741 min ago, past its hold — kept while there is room (requested 1×, downloaded 0×) · 2.4 KB · download usually <1 sDownload
DEV Dev variantOffered on dev-posture instances only (this one is in production posture). The same app with security observing — warns, never denies; for testing on your own isle.

What is all this?

What is a .deb file?

The standard installer format on Ubuntu and other Debian-family Linux — the equivalent of a setup file on other systems. Your computer's own Software Install app reads it, shows what will be installed, and asks for your password through the system dialog. Nothing runs until you approve it.

Online deb vs offline deb — which do I want?

Online is small: it carries the app itself, and the libraries it needs are fetched from the internet when the app is set up — each card lists those libraries and their measured sizes, so nothing downloads invisibly. Offline carries the pip libraries INSIDE the deb (bigger, slower to generate — wheels are fetched at build time), for machines that will have no internet. System engines (e.g. a SPICE simulator) can never ride inside an app deb — they come from the distro's packages or the offline install media, and each card names them.

Why is there a short wait after I click?

These debs are not kept on the server — each one is packaged fresh at the moment you ask (analyze shared payload → package module files → write manifest → assemble deb → stream to you), then kept at least three slow-connection downloads long, then only evicted when room is needed, and freed after a day untouched. The wait shown on each card is the median of that app's recorded generation times — measured, never invented.

What do "pre-prepped" and "generated on demand" mean?

Pre-prepped files are built ahead of time and sit ready on this server, so the download starts instantly. Generated on demand files are packaged fresh at the moment you ask for them — you wait briefly while the server builds your copy, and the server deletes its copy after delivery instead of keeping a duplicate on disk. Each item on these pages says which kind it is.

What are the "shared payload" files some apps mention?

When two apps contain identical files, those files are factored into one shared deb both apps depend on, so the content installs exactly once — the installer enforces it. Install the shared deb first; each app card links it when it applies.

How does an installed app become live?

Installing an app deb stages its code and data under /var/lib/polari/apps/. The running instance admits staged apps through the dynamic-modules machinery, which is still in review — until it lands, an administrator has to admit the module on the instance manually. This page will say so until that changes; nothing happens invisibly.

What ends up on my disk, and where?

Programs install into the system software areas (/usr, /opt) and app data lives under /var/lib/polari. The .deb file you downloaded is only the delivery vehicle — once the install finishes it is safe to delete from your Downloads folder.