Open source · self-hosted · WireGuard

Your own private network, on a server you own.

Covee connects your people and devices over direct, encrypted connections, wherever they are. One command builds the network on your server, sign-in and certificate included. No per-user limits, and no Covee service in the middle.

Download for Mac Read the guide

Covee for Mac needs Apple silicon and macOS 15 or later. The covee command runs on macOS and Linux.

$ covee setup
Covee setup builds a complete network on a server you choose. Nothing is changed until you confirm the summary at the end.
…
Summary for network office (Example Co):
  • Server ubuntu@203.0.113.20 will be dedicated to Covee (SSH from 198.51.100.0/24 only)
  • Sign-in: Microsoft (Entra ID / Office 365)
  • A free Let's Encrypt certificate for covee.example.com and console.mesh.example.com
? Set up now (Y/n): yes
[3/13] Set up Microsoft sign-in
[5/13] Get the certificate for covee.example.com
  Certificate issued by R11, valid until 16 January 2027.
[10/13] Build the Covee services (about 10 minutes)
[13/13] Check the network

Network office is running at https://covee.example.com.

Three parts, all of them yours.

The covee command builds and runs the network from your computer. The server coordinates and relays. Your devices talk to each other directly, end to end encrypted; the server cannot read that traffic.

Your computer covee

Sets the server up over SSH, registers sign-in, gets the certificate, and later updates, backs up and renames the network, using your own SSH, AWS and Azure logins.

macOS or Linux
keys in ~/.config/covee or Parameter Store

Your server Ubuntu 24.04

Runs the coordinator, a relay, sign-in and the admin console in hardened containers. Open to the internet on two ports only.

TCP 443 · coordinator, sign-in, relay
UDP 3478 · STUN
SSH only from networks you allow

Your devices WireGuard

Get private addresses and names, and connect directly when they can, through the relay when they cannot.

laptop.mesh.example.com · 100.64.0.7
Covee for Mac · Tailscale clients

Everything a network needs, set up for you.

covee setup does the hard parts of running your own coordinator, and checks everything before it changes anything.

Sign-in people already have

Microsoft Entra ID, Google and Apple, or Covee's own accounts with a passkey or a password and authenticator. Each network registers its own Microsoft app and group.

A hardened server

A firewall that admits only what the network needs, SSH limited to one key-only account, and services running unprivileged with read-only file systems.

DNS and certificates

Records kept in Route 53 or Cloudflare, a home address followed as it changes (with Route 53), and a Let's Encrypt certificate proved through DNS, so no port needs to be open first.

A private admin console

People, devices, keys, access rules and the gateway, with every change recorded. Reached through an SSH tunnel, or from inside the network, never from the internet.

Backups you can restore

Encrypted snapshots, checked on your computer, that rebuild the network on a new server with every device, account and setting.

Exit nodes and shared networks

A device can send others' internet traffic out through itself, or share the network behind it, once an administrator approves it.

Reach what only your server can.

Turn on the gateway, and devices can reach a cloud's private networks through your server, or leave through its address for services that allow only that one. You choose each destination and who may use it. Everything else goes directly.

Address ranges or host names. Names are looked up from the server, so a private endpoint gets its private address.
Private DNS. Names like vault.azure.net resolve through your cloud's resolver.
Access kept in step. The console writes the matching access rules, and never touches rules it did not add.

Through the gatewayTraffic to these destinations goes through the gateway device; everything else goes directly.

+ Add destination

Name	Destinations	Who	Status
Cloud private networks	`10.40.0.0/1610.41.0.0/16`	Everyone in the network	Active
Production database	`db-0.example.net → 198.51.100.7db-1.example.net → 198.51.100.8`	alice@example.com, bob@example.com	Active
Key vault	`vault.example.net → 10.40.7.4`	Everyone in the network	Active

Host names are looked up from the server every 5 minutes. Devices use these routes when the app’s gateway setting is on.

Running in about fifteen minutes.

You need a fresh Ubuntu 24.04 server reachable on TCP 443 and UDP 3478, a domain name, and a way for people to sign in.

Install the command

With Homebrew on macOS or Linux, or from the releases page.

brew install covee-io/tap/covee

Build your network

It changes nothing until you confirm a summary of what it will do.

covee setup

Connect your devices

Open Covee for Mac, or point a Tailscale client at your server, and sign in.

sudo tailscale up --login-server=https://covee.example.com

Devices

Covee's own apps, and Tailscale's open clients pointed at your server.

Apple silicon · macOS 15+

Covee for Mac

A menu bar app with sign-in, exit nodes and the gateway switch. Signed with a Developer ID and notarized by Apple.

Download Covee.dmg, or brew install --cask covee-io/tap/covee

iOS

iPhone

Covee for iPhone is in testing. Meanwhile, Tailscale's iPhone app joins your network once your server is set as its coordination server.

How to set it up

Linux · Windows · Android

Everything else

The standard Tailscale clients, with your server as the login server. Servers can join with a one-time device key.

Connect your devices

Open source, end to end.

Covee is free under the Apache 2.0 license. It builds on Headscale, an open-source implementation of the Tailscale control server, and on Tailscale's open-source client engine. Nothing reports home: the command and the apps talk only to your server and the providers you choose.

View the source on GitHub

License: Apache 2.0
Coordinator: Headscale
Encryption: WireGuard, keys kept on each device
Server: Ubuntu 24.04, amd64
Telemetry: None