Skip to main content

Architecture

Understanding the Camouflage architecture will help you plan and deploy your infrastructure effectively.

Architecture Overview​

System Components​

Relay Servers​

The backbone of Camouflage's infrastructure:

  • Protocol: QUIC for low-latency, reliable connections
  • Scalability: Horizontal scaling with load balancing
  • Deployment: Docker-based for easy orchestration

Management Backend​

Django-based API and WebSocket server:

  • RESTful API for management operations
  • WebSocket support for real-time updates
  • PostgreSQL database for persistent storage
  • Activity logging and audit trails

Web Console​

React-based frontend for administration:

  • Network management
  • User administration
  • ACL configuration
  • Real-time monitoring

Gateway Nodes​

Entry points to private networks:

  • Daemon containers for network isolation
  • Dynamic creation based on network configuration
  • Automatic cleanup and lifecycle management

Client Applications​

End-user applications for network access:

  • Desktop applications (Windows, macOS, Linux)
  • Mobile applications (iOS, Android)
  • CLI tools for automation

Network Flow​

Community Edition Flow​

Enterprise Edition Flow​

Deployment Models​

Community Edition Deployment​

All-in-one deployment for up to 10 nodes:

Best for:

  • Small teams and organizations
  • Development and testing
  • Up to 10 connected devices
  • Single location deployment

Enterprise Edition - Single Relay​

Suitable for medium-scale deployments:

Best for:

  • Growing organizations
  • Multiple network locations
  • Unlimited nodes
  • Single region

Enterprise Edition - Multi-Relay​

Production deployments with high availability:

Best for:

  • Enterprise deployments
  • High availability requirements
  • Global distribution
  • Auto-scaling workloads
  • Multi-region presence

Security Architecture​

Security Features:

  • Transport Encryption: QUIC with TLS 1.3 for all connections
  • Key Exchange: Hybrid post-quantum + classical cryptography (Noise + PQXDH)
  • Authentication: Per-node auth keys required for every connection — unauthenticated clients are rejected
  • Fixed IP Assignment: Each node receives a persistent IP address, enabling stable firewall rules and ACLs
  • Authorization: Role-based access control (RBAC) with network ACLs
  • Network Isolation: Separate daemon containers for each network
  • End-to-End Encryption: All traffic encrypted between nodes
  • Auditing: Comprehensive activity logging and audit trails
  • Monitoring: Real-time security monitoring and alerts

Next Steps​