What is SideServices?
SideServices is a private, self-hosted service mesh. Run the single sidehub binary on any device; your services become reachable from anywhere on localhost, with no public ports, no public DNS, and no vendor control plane involved.
Access is deny-by-default and per-service. A service stays invisible until your controller grants it to a specific peer — and is revoked the same way. Every decision is logged locally.
Transport is WireGuard with hybrid post-quantum key exchange (X25519 + ML-KEM, Ed25519 + ML-DSA). The relay is untrusted by design — it can’t read your traffic, so it can be anyone’s.
How it works
Drop the sidehub binary on your controller, open the setup page, and issue a one-time bootstrap code. Paste it on the next device. It pairs, builds encrypted tunnels to every hub, and exposes the federation’s services on localhost. That’s the whole setup.
Appliances
SideServices also ships as ready-to-flash appliances. The Federation appliance is the easiest way to self-host an entire federation on a Raspberry Pi — for a company, an incident-response kit, a temporary deployment or a lab; the IoT appliance protects an industrial or IoT device by exposing only the services you choose, with no web traffic by default. Both are built on gokrazy, with atomic A/B over-the-air updates and token-based enrollment (as simple as plugging in a USB stick). Read the announcement.
Alpha access
SideServices is currently in alpha. Visit sideservices.io to learn more, or get in touch if you want early access.