INSIDE KODACHI 9
Your ISO is the client layer. Behind it, Kodachi coordinates authentication, signed card assignment, DNS protection, protocol routing, worker fleets, external-provider configs, and on-device emergency defenses. Two racks power on below: the on-device rack you boot, and the kodachi.cloud master rack it talks to over a WAN uplink. Watch the flows move: auth handshakes travel up, signed cards ship down, traffic leaves through the exits.
Five steps from power-on to a guarded tunnel
Every booted Kodachi device walks the same path. The rack above is this flow, stacked.
Boot
The ISO comes up. integrity-check verifies the signed Rust components before anything else runs.
Authenticate
The client requests a 64-char challenge from the master node, solves it locally, returns the solution, gets a hardware-bound session token.
Card assigned
Master matches your tier to a fresh card from the matching pool. The card contains every protocol config you need.
Tunnel up
routing-switch brings the selected protocol online. dns-leak verifies the resolver is inside the tunnel.
Guarded
Heartbeat every 2 minutes, security score recomputed live, health-control watchdog ready to fire panic at any tier.
Protocol routing and DNS protection
Each card carries every daemon. The client drives which one goes live.
Tunnels
WireGuard tunnel client-a (Free) to its current NORMAL worker, kernel-level, mint-cyan.
V2Ray tunnel client-b (Premium) to its current low-density worker, VMess obfuscated.
Shadowsocks tunnel client-c (Dedicated) to its current isolated single-tenant worker, censorship-resistant.
Multi-Tor + HAProxy client-d (Free) to a Tor relay, 3-hop anonymous. Worker Tor SOCKS is VPN-only: it binds to the OpenVPN/WireGuard subnets, never a public IP, so the remote Tor route layers on an active VPN tunnel and is never an open proxy.
DNS layer
1000+ resolvers in 15 categories; DNSCrypt, DoH/DoT, Pi-hole filtering, and DNS-over-Tor all ship in every card and are driven on the client by dns-switch.
each card = { vps_info, services{ openvpn, wireguard, shadowsocks, v2ray, xray, hysteria2, mita, dante, tor, dns } } · signed JSON
Master keeps three privilege tiers
Matched by tier on auth, regenerated on cron */5m. Current inventory: -- signed JSON cards across the pools, loaded from the master API.
Shared, high-density VPS. Every protocol included. Cards regenerated on cron when the pool dips below the threshold. Personal-use tier, same OS and binaries as the paid plans. Current node assignments come from the master API.
Low-density shared VPS for consistent performance. Prioritized exits, lower contention, faster card rotation. Same protocol surface. Commercial usage rights included. Current node assignments come from the master API.
Fully isolated VPS per customer. Bespoke configs per holder. Dedicated worker mapping. Intended for organisations and serious operational use. Current allocation: -- dedicated seats across -- customers.
External providers and on-device defenses
The Kodachi fleet is the turnkey path, not the only path.
External VPN Providers
The same dashboard's External VPN Providers tab catalogs 13 third-party providers plus a custom pseudo-provider that auto-detects pasted .ovpn / WireGuard / Shadowsocks / V2Ray / Hysteria2 configs and vmess:// / vless:// / ss:// URI schemes plus Clash YAML / sing-box JSON subscriptions.
On-device defenses + AI
3-tier PANIC (Soft / Medium / Hard), Kill Switch, Dashboard NUKE, Threat Watchdog, Security Score, MAC randomize, RAM/Browser/Logs wipe, -- workflow profiles. The Kodachi AI workspace adds 8 AI binaries (ai-cmd, ai-gateway, ai-admin, ai-discovery, ai-learner, ai-monitor, ai-scheduler, ai-trainer) on a 7-tier offline-first engine, with KAICS as the plain-English command bar. Runs on every Kodachi laptop, independent of the worker fleet.
The rack in numbers
Loading current rack totals from /apps/stats_api.php…