Designed and run a commercial private VPN service: a multi-server network across several hosting providers in different countries, a self-healing mesh backbone, a control panel built from scratch, and automated delivery of client configurations.
The problem
A client wanted a private VPN service for a closed circle of users. He provided the servers and the clientele — all the engineering, from architecture to user support, was on me. The main requirement was reliability: the servers are rented from different hosting providers, any of which can go down, and users should never notice when one does.
My role
This is a commercial engagement; I have been working on it solo since 2025 — architecture, development, operations, and user support.
What I built
- A self-healing mesh backbone — the network started as a classic set of encrypted tunnels with static routes; in 2026 I moved the backbone to a mesh overlay. Nodes constantly measure latency to each other, and a distance-vector protocol builds routes from the actual metric: when a link or a whole server fails, traffic shifts to the next-best route within seconds — nobody has to touch anything. The backbone runs on an open-source mesh engine that I extended for this network’s needs in Go: a deny-by-default access policy, route tags for source-based routing, an encrypted cache for centralized configuration, and stability fixes.
- A network control panel — from scratch — a web panel (Vue 3, Express, SQLite) that describes the entire network: nodes, links, groups, access policies. Configuration is versioned; every edit is an atomic commit with conflict detection, and each commit re-validates the config and seals it into a bundle for distribution to the nodes. Edits from another session show up live (SSE), so two administrators never overwrite each other.
- An integration API — a separate API layer with token auth and subscription accounting (plans, expiry dates) — the foundation for automated delivery of client configurations.
- Mass provisioning — automated generation of client configurations and QR codes in waves — dozens of configs at a time instead of assembling each one by hand.
- Infrastructure and operations — VPS across several providers, Proxmox virtualization, Docker containers, routing on network equipment, monitoring, and backups.
Results
- The service has been in production since 2025 and runs continuously; the user base is dozens of people.
- Users don’t notice when a server or a link fails — the network reroutes itself.
- The entire network is managed from a single panel: versioning, validation, and distribution are automatic.
Stack
Go · Node.js · TypeScript · Vue.js · Express · SQLite · Docker · Proxmox · Linux
