Something of your own.
Write a heading and a few words, or upload a website. Save a draft, then publish a complete checked snapshot from the friendly local panel.
GLOWMESH 0.3 · BY LUMINOSITY
Your site.
Many ways
home.
A little Rust server for a more connected world. Publish through Tor or mesh, keep signed copies close, and take your corner of the web with you.
15.5 MB · Windows, Mac, Linux & Raspberry Pi
No account. No subscription. No compiler needed for the included executables.
Built in RustOne native server executable
Signed with Ed25519SHA-256 checks for every file
Offline capablePortable verified .gmb bundles
Small-computer friendlyA dedicated Low Resource profile
Keep your own little light on
More ways to stay within reach.
Make a page, choose your connections, and let trusted copies carry it farther.
Keep several paths open.
Local access works immediately. Add installed Tor for an onion address, or select an existing Yggdrasil mesh interface. Both can run together.
Let a good thing travel.
Pin a publisher’s key, save a verified copy, and read it offline. Export a bundle or serve the copy through your connections under its original signature.
Identity stays with the content. You supply the addresses and choose the publishers. Onion and literal mesh-IP routes avoid conventional DNS; ordinary hostnames still use it. Glowmesh does not perform global peer discovery.
You don’t have to be leet
Open it. Make a page. Publish.
The download contains all six executables. Your launcher chooses the right one.
- Download & extract.Extract the entire ZIP. Keep its folders together.
- Start your launcher.Your browser opens the private panel. Keep the terminal running.
- Make it yours.Save your page draft, then choose Publish changes.
| Your computer | Start normally | Use fewer resources |
|---|---|---|
| Windows x64 Windows 10/11 · Intel/AMD | Start_Glowmesh.cmd | Start_Low_Resource.cmd |
| Mac Apple silicon or Intel · macOS 11.7.1+ | Start_Glowmesh.command | Start_Low_Resource.command |
| Linux / Raspberry Pi x86_64, ARM64 or ARMv7 | sh ./Start_Glowmesh.sh | sh ./Start_Low_Resource.sh |
If the browser doesn’t open, copy the private link from the terminal. Ctrl-C there stops the server. Tor and mesh start off; they require separate Tor/Yggdrasil installations. The original ARMv6 Pi 1 and Pi Zero need a different build.
Windows/Mac builds are unsigned and awaiting native-device testing. Platform details are in the guide and verification report.
Open the machine
Small surface. Substantial internals.
Every copy has a publisher. Every file has a hash. Changes are checked before they replace a saved version.
01 · Immutable Rust snapshots
Tokio + Hyper + shared immutable bytes. Public HTTP requests read a prepared site map through Arc and Bytes, rather than resolving arbitrary disk paths on each request. The server handles GET/HEAD with bounded connections, rates and deadlines.
The embedded control panel uses vanilla HTML/CSS/JS in your browser. The application crate forbids unsafe Rust; platform work is supplied through dependencies. Standard mode runs two async workers; Low Resource uses a current-thread runtime.
Drafts stay separate from the published snapshot. An individual response gets complete old or new bytes; slow readers can finish an earlier version.
02 · Ed25519 identity & version rules
A random 32-byte Ed25519 seed creates your signing identity. Its public key is 64 lowercase hex characters. The manifest records the format, publisher, title, sequence, and sorted file paths, lengths and SHA-256 hashes.
The signature covers a domain-separated prefix and typed compact JSON. Glowmesh reserializes the typed manifest and performs strict signature verification. The exact encoding is specified in the protocol document.
Readers pin the full key. Higher sequences can update it; lower sequences and changes at an equal sequence are rejected. Initial key confirmation establishes who you choose to trust. The signature does not prove that the page is benign or globally newest.
03 · Six routes, verified at the destination
Each saved publisher can have up to six explicit HTTP(S) root addresses, tried in order. The expected identity and each file are verified before a candidate replaces the saved copy. Failed attempts keep the previous copy available.
The fetcher has 12-second connection, 45-second request, and 120-second route deadlines. It bounds streamed bodies, rejects redirects and URL credentials, and ignores proxy environment settings. HTTPS uses rustls/ring and bundled WebPKI roots.
There is no automatic peer discovery, distributed name registry or multi-writer consensus in this release.
04 · Portable, verified offline bundles
A .gmb starts with GLOWMB01, then a four-byte big-endian envelope length, signed JSON, and file bytes in manifest order.
The parser rejects bad signatures, hash/length mismatches, unsafe paths, truncation and trailing bytes. It constructs a snapshot in memory rather than extracting arbitrary paths from an archive.
Carry a bundle by USB, import it, confirm its publisher, and open it locally. Share a saved copy through your connections while retaining the original signature. Bundles contain public content; private signing and onion keys stay behind.
05 · A local panel with a separate boundary
The panel binds to 127.0.0.1 on a separate port. Each launch makes a fresh 256-bit bearer token. The private link supplies it in a URL fragment; the UI moves it to tab session storage and clears the fragment.
Constant-time token comparison, exact Host checks and same-origin mutation checks protect the API. There is no CORS or cookie-authentication mode. Saved pages run on separate origins and receive no panel token.
Mutations are serialized. Status can show a cached view during longer work. The private link grants control of this local instance; keep it with your account.
06 · Tor, mesh & private state
Managed Tor has its own persistent identity and no publishing SOCKS/control listener. Its HTTP backend is a private Unix socket on Mac/Linux, and dynamic loopback TCP on Windows. Yggdrasil binds a selected existing mesh IPv6 address.
Onion downloads use local SOCKS5h, so Tor resolves the destination. No direct retry occurs for an onion URL. Mixing onion and direct routes requires explicit permission.
Unix modes and ownership protect private state; Windows uses protected account/SYSTEM ACLs. Capability-relative loading and portable filename rules constrain public content. Snapshot writes use temporary files, sync and replacement rename. Full boundaries are in SECURITY.md.
Go deeper: full technical README · byte-level protocol · source and development guide. Markdown links also open in a text editor.
For the little machines
Less background work.
The same friendly controls.
Low Resource keeps the signature, authentication and path checks. It lowers content and connection budgets, uses one async runtime thread, and lets you choose when to fetch updates.
Its launcher creates a separate my-site-lite folder. Existing stricter settings remain stricter. Enable only the network connections you need.
These are content limits, not a hard RAM cap. Active snapshots and temporary transfers can coexist; Tor, Yggdrasil and browser memory are additional.
| Budget | Standard | Low Resource |
|---|---|---|
| One file | 32 MiB | 2 MiB |
| One site | 256 MiB | 8 MiB |
| Saved publishers | 8 | 2 |
| Saved bundles | 512 MiB | 32 MiB |
| Connections / listener | 128 | 16 |
| Copy updates | Optional automatic | Manual |
Checkable work
Built to be inspected.
Source, locked dependencies, test suites, protocol documentation and a verification report are included.
38 passing tests.
20 Rust tests, nine HTTP/process checks and nine app/replication scenarios. UI interactions passed in standard and Low Resource modes.
Two Pi architectures.
Four integration scenarios passed on each ARM64 and ARMv7 executable under QEMU. Physical Pi performance is not measured here.
Native executables.
Windows x64, Intel Mac and Apple silicon Mac were cross-compiled and inspected. Native runtime testing remains to be completed.
Release checks recorded October 6, 2026. The recorded RustSec scan found zero known advisories or warnings. Two Unix-socket tests were skipped by the environment; live Tor/Yggdrasil and full browser-layout checks were not run. Read the exact coverage →
Download checksum
SHA-256 for Glowmesh_0.3.0_All_Platforms.zip:
5399f466d811ccc4b10469fc2459cc0672d38d09ba818c95fe49ddd0343baf76
A checksum detects corruption against this published value. It is not a publisher signature. The download also contains checksums for its individual files.
A page that travels lightly, too
Plain HTML.
Quiet by design.
This homepage uses zero JavaScript, zero external fonts, zero image downloads and no analytics code. Its technical panels are native HTML disclosures. The server download loads only when selected.
GitHub Pages serves this public page and downloadable files. Run Glowmesh on your own computer or another host for the local control panel, onion publishing and mesh connections.
Build from source
Use Rust 1.94+ and a platform C toolchain.
cargo build --release --locked
./target/release/glowmesh \
--config my-site/glowmesh.toml appWindows output: target\release\glowmesh.exe.
Development guide · Publish this homepage
This kit’s Rust CI is manual, so editing documentation does not trigger compilation.
Independent work, kept in motion
Made by Luminosity.
With GPTeus.
Software, cinema, music, writing, and strange luminous machines. Help keep the little lights on and the next experiment moving.
Support · $unixarcade ↗Share it. Test a build. Improve a guide. Send the signal farther.