Make your home-hosted service reachable over HTTPS — no router configuration, no port forwarding. Bring a domain you already own, or just pick a free name under mera.network.
EphemNet is a real authoritative DNS server for domains delegated to it. Every domain resolves one of two ways:
The DNS answer is your server's own real IP. Zero ongoing involvement from us after that — exactly like ordinary DNS. No relay, no bandwidth cost, no protection.
The DNS answer is our relay's IP. Your server — even behind NAT, with no public IP at all — runs a small agent that holds a persistent tunnel to us. We route by TLS SNI and forward the still-encrypted bytes through, untouched. We never decrypt your traffic; TLS terminates at your own server.
Turning relay mode on costs nothing extra — it's not a separate "protection" SKU bolted onto your domain. The two modes do have genuinely different real costs, though, and the pricing reflects that honestly rather than hiding it: direct mode never touches our infrastructure at all (DNS just answers with your own real IP), so it's genuinely free; relay mode carries your domain's actual traffic through our own relay for the life of the connection, which is a real, metered cost on our end — covered free up to a fair amount, with additional usage beyond that as an optional top-up, not an arbitrary markup on something that was free to provide. Either way, the real comparison is free alternatives like Cloudflare Tunnel, DuckDNS, or ngrok's free tier, not domain registrars. This isn't a static choice either: you can switch a domain between direct and relay on demand (say, when an attack starts), through the same authenticated update channel used for anything else about your domain.
No domain of your own yet? Pick any free name under mera.network instead — same registration, same price, same real TLS certificate. Want to share it with someone else rather than just use it yourself? Add HTTP Basic Auth on top, so it isn't wide open to anyone who finds the name.
Cloudflare Tunnel is free, unmetered, and backed by a global edge network we can't match on latency or ease of setup. If that were the pitch, it wouldn't be worth making.
The actual, narrower edge: every registrar and every major DNS provider requires an account tied to a real identity — and has the power to unilaterally decide you're not welcome anymore. Ownership here is a bearer credential, paid for with Lightning, no KYC. There's no account to suspend and no company relationship to terminate.
That matters specifically to people who have real deplatforming risk as part of their threat model — independent journalists, minority-language communities, anyone whose legitimate service is one policy decision away from being cut off. It's not a general "Cloudflare alternative" pitch, and we'd rather say that plainly than oversell it.
Certificates — we support ACME DNS-01 automation: your own
certbot/lego/etc. still talks to your CA of choice
directly, we just publish the _acme-challenge TXT
record it needs. Works identically whether you're in direct or
relay mode.
Ownership — every domain gets its own
owner_token at registration, a bearer credential, not
an account login. Manage an existing domain's resolution — switch
between direct and relay, renew it, update its IP — any time at
owner.mera.network using
that token. The end state is full capability-key, macaroon-based
ownership; today's owner_token is a real, working
placeholder for that, not a mock.
ephemnet-agent is the reverse-tunnel client: run it
on any host with no public IP of its own to make it reachable
through relay mode. Single static binary, no install process.
A decentralized relay swarm — route to a host by a rotating, seed-derived identifier instead of a domain name, resilient to DDoS, usable behind NAT. Real design work, real prototypes, genuinely hard to get right at that scope.
Realizing that vision's actual value doesn't require the swarm to start: a single, well-run node doing real DNS resolution — direct or relayed — with the same capability-key ownership pattern already proven elsewhere delivers the same practical outcome sooner, with the swarm/federation layer deferred until real usage actually demands it, not abandoned.
Direct and relay resolution, ACME DNS-01 automation, and on-demand mode-switching are built and tested. Real macaroon- based ownership (replacing today's manually-provisioned domains) is the next real milestone.