A private overlay is described which is carried inside TLS 1.3. Application streams are multiplexed over GET, WebSocket, HTTP/2, QUIC, or HTTP/3 and are sealed with ChaCha20-Poly1305. On the public path the session is ordinary HTTPS, and may therefore be passed through a CDN, reverse proxy, or TLS terminator. Short disconnects and packet loss are tolerated. The intended use is operator access: a laboratory LAN reached from outside, a server fleet, or a site-to-site path.
The protocol is loft/1.0. Connections are shared as loft://. Apache License 2.0.
This site is the specification. The reference node and clients are in the repository.
flowchart LR
subgraph Client["loft client"]
App["SSH · browser · curl"] --> In["SOCKS5 / TUN"]
In --> Mux["mux<br/>Open / Data / Close / Dgram"]
Mux --> Seal["ChaCha20-Poly1305"]
Seal --> Front["get · ws · h2 · quic · h3"]
end
Front -- "TLS 1.3 HTTPS" --> Edge["CDN / reverse proxy"] --> Node["loft-node"]
Node --> Dest["lab · fleet · site"]
Holder while the front is rotated.gap_hold_ms (8 s by default). Resume is performed with a fresh 0x02 and the same instance_id; inner TCP is left standing.| protocol.md | The wire protocol. A third-party client or node may be implemented from it. |
| architecture.md | This tree: controller, relay, client, overlay. |
| guide.md | Build, config, decoy, roster, Debian. |
| share.md | Import URI: loft://, .loft (one or several connections), QR. |
| keenetic.md | KeeneticOS Entware client. |
| ios.md | iOS Packet Tunnel. |
| android.md | Android VpnService. |
| aurora.md | Aurora OS ConnMan. |
| yandex-cdn_ru.md | Yandex Cloud CDN operator guide (RU). |