vapp-net Tiếng Việt

In development · not offered to other organisations

vapp-net

Your server dials out to an edge in Việt Nam over one encrypted QUIC connection. Visitors type your name; the edge holds the certificate and carries each request through that tunnel. The server opens no inbound port, needs no public IP address and no root.

  1. Visitor
  2. Edge in Việt Nam
  3. Your server

Status

vapp-net serves only our own websites, every day since 21 October 2026, through two edges in Hà Nội.

Offering an encrypted tunnel to another organisation needs civil-cryptography and telecom licences under Vietnamese law. We will not offer it before we hold them. This page is information only: no sign-up, no price list, no trial.

How it works

  1. 01

    The server dials out

    A small program next to your application connects out to both edges and proves it holds the device’s private key. No port opens inbound.

  2. 02

    Prove the name

    You publish a TXT record at _vapp-challenge.<your name>. The edge routes a name only after its proof checks. A proof expires after 30 days and is checked again before every certificate.

  3. 03

    The edge holds the certificate

    A public CA issues it over DNS-01, one name per certificate, renewed automatically. Its private key stays on the edges.

Built so these cannot happen

The edge cannot choose where to connect
The edge sends a name, never an address. Your server looks the name up in its own list, which has no default entry. A compromised edge still cannot reach anything on your network that is not on that list.
A stolen credential is useless
The credential names the device’s public key. Every connection must prove it holds the private key, over a value taken from that connection’s own TLS session, so a proof cannot be carried to another connection. Credentials expire after 30 days and renew weekly.
Errors tell a prober nothing
A server that is down, a server that refused, a name with no route: the visitor gets the same answer, byte for byte. A prober cannot tell them apart.
No record of visits
The edge writes no log line for a request it delivers: not the address, not the page. Every edge is in Việt Nam.

Measured

Only numbers we measured ourselves. Each protection above is tested by breaking it in the code on purpose and confirming the tests fail.

Edge memory added per tunnel (linear from 1 to 100) 56–59 KiB
Server-side program memory, idle 6.3 MiB
Server-side peak memory after 2000 requests, 32 at once 7.9–8.0 MiB

Release build, 3 runs, 19 and 21 October 2026. Rig: Apple M4 Pro, Linux aarch64 in a VM, over loopback.

Latency and throughput on a real network path: not measured yet, so not published.