End-to-end encrypted connections (beta)
An opt-in beta: your devices reach your machines over a WireGuard®-based mesh inside Cua, end to end encrypted, with the relay forwarding only ciphertext.
An opt-in beta: your devices reach your machines over a WireGuard®-based mesh inside Cua, end to end encrypted, with the relay forwarding only ciphertext.
Beta, off by default. Nothing changes unless you turn the mesh on with
CUA_MESH (below). It is meant for the Beta channel of the Cua Spaces app
and will be on by default there in a later beta; stable releases keep the
relay's HTTPS path.
With the mesh on, a device that opens a Space on one of your machines
(relay:<machine>) connects to it over a WireGuard®-based mesh that runs
inside Cua itself, instead of through the relay's HTTPS path. The relay
coordinates the mesh but never holds a session key: shell, files, input,
screen and Keyvault deliveries cross it only as ciphertext.
fd5c:a000::/32) exist only inside Cua, so the mesh never
conflicts with Tailscale or another VPN you already run, and it carries
Spaces traffic only.Both ends opt in: the device you connect from and the machine you host.
CUA_MESH | Behavior |
|---|---|
unset or off (default) | The relay's HTTPS path only, as before. |
prefer | The mesh when both ends and the relay support it; the relay's HTTPS path otherwise, with a log line saying why. |
require | The mesh or nothing: a relay that could read the session is never used. |
CUA_MESH where cua runs (your shell, or the
environment of the cua daemon; restart the daemon with cua daemon stop
after changing it).cua host setup with CUA_MESH=prefer set.
The setting is kept for the host's service until you run setup again
without it.cua spaces ls lists the same machines either way. With prefer, a machine
or relay that does not speak the mesh yet is used over HTTPS, so mixing
updated and older machines works.
The relay applies the rules you already manage:
A desktop view, terminal or agent session over the mesh counts toward your
plan's live sessions, the same as one over the relay's HTTPS path, and one
machine reached both ways at once counts once. Relay hours count only the
time a session's traffic goes through the relay: a direct connection uses
none. cua usage and the app's Settings show both.
Connections belong to the two ends, not to a network path. When a laptop moves from Wi-Fi to Ethernet or its public address changes, traffic moves to the relay for a moment and back to a direct path as soon as one answers. A relay restart does not interrupt direct connections; a connection that was going through the relay resumes when the relay is back.
https://<relay>/m/<machine>/… as before. See
what the relay can see.cua-relay:
prefer uses their HTTPS path quietly.Direct paths use UDP. Each end picks a UDP port on its own; outbound UDP is all it needs. On networks that block UDP, the mesh still works through the relay, over HTTPS to the same relay address as the rest of Cua.
WireGuard is a registered trademark of Jason A. Donenfeld. Cua's mesh uses the WireGuard protocol through Cloudflare's BSD-licensed boringtun; it is not affiliated with or endorsed by the WireGuard project.