INSIDE KODACHI 9
Your ISO is the client layer. Behind it, Kodachi coordinates authentication, signed card assignment, DNS protection, protocol routing, worker fleets, external-provider configs, and on-device emergency defenses. Two racks power on below: the on-device rack you boot, and the kodachi.cloud master rack it talks to over a WAN uplink. Watch the flows move: auth handshakes travel up, signed cards ship down, traffic leaves through the exits.
Five steps from power-on to a guarded tunnel
Every booted Kodachi device walks the same path. The rack above is this flow, stacked.
Boot
The ISO comes up. integrity-check verifies the signed Rust components before anything else runs.
Authenticate
The client requests a 64-char challenge from the master node, solves it locally, returns the solution, gets a hardware-bound session token.
Card assigned
Master matches your tier to a fresh card from the matching pool. The card contains every protocol config you need.
Tunnel up
routing-switch brings the selected protocol online. dns-leak verifies the resolver is inside the tunnel.
Guarded
Heartbeat every 2 minutes, security score recomputed live, health-control watchdog ready to fire panic at any tier.
Protocol routing and DNS protection
Each card carries every daemon. The client drives which one goes live.
Tunnels
WireGuard tunnel client-a (Free) to Neo (NORMAL, NL), kernel-level, mint-cyan.
V2Ray tunnel client-b (Premium) to Owl (Premium, low-density, NL), VMess obfuscated.
Shadowsocks tunnel client-c (Dedicated) to Fox (CUSTOM, isolated single-tenant, DE), censorship-resistant.
Multi-Tor + HAProxy client-d (Free) to a Tor relay, 3-hop anonymous. Worker Tor SOCKS is VPN-only: it binds to the OpenVPN/WireGuard subnets, never a public IP, so the remote Tor route layers on an active VPN tunnel and is never an open proxy.
DNS layer
1000+ resolvers in 15 categories; DNSCrypt, DoH/DoT, Pi-hole filtering, and DNS-over-Tor all ship in every card and are driven on the client by dns-switch.
each card = { vps_info, services{ openvpn, wireguard, shadowsocks, v2ray, xray, hysteria2, mita, dante, tor, dns } } · signed JSON
Master keeps three privilege tiers
Matched by tier on auth, regenerated on cron */5m. Live snapshot 02 Jul 2026: 2295 signed JSON cards across the pools.
Shared, high-density VPS. Every protocol included. Cards regenerated on cron when the pool dips below the threshold. Personal-use tier, same OS and binaries as the paid plans. Live: Neo node (NL).
Low-density shared VPS for consistent performance. Prioritized exits, lower contention, faster card rotation. Same protocol surface. Commercial usage rights included. Live: Owl, Hex and Elk nodes (NL).
Fully isolated VPS per customer. Bespoke configs per holder. Dedicated worker mapping. Intended for organisations and serious operational use. Live: Fox node (DE), 5 dedicated seats, 1 customer.
External providers and on-device defenses
The Kodachi fleet is the turnkey path, not the only path.
External VPN Providers
The same dashboard's External VPN Providers tab catalogs 13 third-party providers plus a custom pseudo-provider that auto-detects pasted .ovpn / WireGuard / Shadowsocks / V2Ray / Hysteria2 configs and vmess:// / vless:// / ss:// URI schemes plus Clash YAML / sing-box JSON subscriptions.
On-device defenses + AI
3-tier PANIC (Soft / Medium / Hard), Kill Switch, Dashboard NUKE, Threat Watchdog, Security Score, MAC randomize, RAM/Browser/Logs wipe, 96 workflow profiles. The Kodachi AI workspace adds 8 AI binaries (ai-cmd, ai-gateway, ai-admin, ai-discovery, ai-learner, ai-monitor, ai-scheduler, ai-trainer) on a 7-tier offline-first engine, with KAICS as the plain-English command bar. Runs on every Kodachi laptop, independent of the worker fleet.
The rack in numbers
Live snapshot 02 Jul 2026 via /apps/stats_api.php: 93 active sessions (peak 146 on 29 Jun 2026), 1753 challenges solved, 1084 logins and 2350 cards issued in the last 7 days.