Fabric

Overview

Fabric is the private network and runtime for every machine you own. One place for your laptops, servers, NAS boxes, edge devices, legacy SSH hosts, and a cloud workspace that behaves like another machine in the same fleet.

You reach them, control them, move data between them, and publish real applications from them — without opening inbound ports, running a VPN, or maintaining a bastion.

How machines join

Install a small agent on any device. It connects outbound only. No inbound ports, no firewall rules, no public IP required. It works behind NAT, on mobile data, and on networks you do not control.

Prefer not to install anything? Point Fabric at a box over SSH (password or key). That host becomes a first-class machine in the same fleet: shell, file transfer, the same addressable name.

Your cloud workspace is treated as a machine too. Same model for “my laptop,” “the office NAS,” and “the hosted runtime.” Folders there can be site roots. A name, once registered, is addressable even before the agent is online.

Every account has a large pool of machine slots. A released slot stays reserved for a cooling window so IDs stay stable for anything already pointing at them.

See and drive the desktop

If a machine has a logged-in graphical session, Fabric can put you in front of it.

• Live view of one display or every display
• Mouse and keyboard forwarded as real input — clicks, right-clicks, scroll, chords, media keys, the full set
• Pointer coordinates mapped through each display’s width, height, and origin, so multi-monitor layouts work correctly
• Screenshots into your storage as ordinary image files
• Inline viewer in the control panel, plus an expand control that opens a filled window for focused work

Headless servers, offline agents, and pure SSH targets do not appear in the remote viewer. Only machines that answer with real display geometry are listed. That is intentional: there is nothing to drive without a desktop session.

Shell, files, and system operations

Against any registered agent you can:

• Run shell commands (blocking, or background with a process handle you can later stop)
• Read and write files under the agent’s configured root
• List drives and folder contents
• Set how often the agent checks in (from one second up to an hour), so battery and metered links stay polite

Against SSH hosts you get the same spirit: remote commands and file transfer, without an agent.

Tunnels and one-file shares

Need the outside world to reach something on a machine?

• Tunnel a port. Fabric gives you a public HTTPS URL. Traffic rides the agent’s existing outbound connection. No port forwarding, no static IP. The process stays on the device and answers each request. Close the tunnel and the URL dies immediately. If the agent stays disconnected long enough, the tunnel tears down on its own.
• Serve a single file. One path on the machine becomes a public URL. Nothing is uploaded ahead of time; bytes stream from disk on demand. Range requests work, so video can seek.

Use tunnels for apps and APIs. Use served files for reports, builds, and media you do not want to copy into the cloud first.

Mesh: machine to machine

Group registered machines into a peer network. Then:

• Transfer files directly between two peers. Bytes travel machine to machine; they do not climb to the server and fall back down. Transfers are non-blocking; you can poll progress.
• Share a port from one peer onto the others’ localhost. Only members of that network reach it, and only on their own loopback. Nothing is exposed to the public internet.

That is the difference between “everything through the cloud” and a real private mesh.

Private names and network mapping

Inside your fleet, give machines names that resolve the way you expect. Map hostnames to machines and addresses so nas.home, pi.lab, or whatever you choose just works on the private side. Public DNS stays for the sites you deliberately publish.

Hosting: real runtimes, not only static files

Point a folder — on any machine in the fleet, or in the cloud workspace — at a site. On each visit Fabric runs or serves it. There is no separate “upload then deploy” ritual: edit on the machine, refresh, and the live site reflects what is on disk.

Supported runtimes include:

• PHP — full extension set (image processing, database drivers, crypto, XML, and the rest)
• Python — scientific and ML stack (NumPy, pandas, SciPy, scikit-learn, OpenCV, PyTorch, Transformers, and more)
• Node.js
• Java
• Ruby, Perl, Bash
• Compiled WebAssembly modules
• Static assets with correct content types (HTML, CSS, JS, images, fonts, documents, audio, video with range support)

Long-running backends can stay up after the script that started them returns — the model a normal API expects. Request path, query string, body, and cookies reach your code the way they would on a conventional host.

Sites can live:

• Entirely in the cloud workspace
• With a root folder on a device (Fabric pulls from that machine on visit and runs in your workspace — distinct from a port tunnel)
• Behind custom domains and subdomains you control

Subdomains under the platform domain, or under a domain you point or fully delegate. Apex and wildcards are supported. Certificates follow the domain setup you choose. Mailboxes can sit on delegated domains when you want email on the same name.

Static and dynamic paths share one routing model: directories, exact files, and sensible fallbacks. What you test on a machine’s local agent port behaves the same way when it is published.

Wake, status, and safety rails

• Wake-on-LAN through an already-online agent that shares the target’s local network (magic packets do not cross the public internet)
• Online status and transfer progress you can poll before a long run
• Commands against offline agents wait up to a ceiling, then time out cleanly; the work remains addressable if the agent returns
• Unregistered machine IDs and full slot pools fail loudly so scripts do not silently target the wrong thing
• Desktop input, screenshots, and live view require a real graphical session — headless boxes are not faked

Activity and control

A single activity stream shows tunnels opened, transfers finished, sites created, screenshots taken, and the rest of the fleet’s work. From the same panel you manage machines, mesh membership, tunnels, served files, hosting roots, domains, and settings. Usage against your plan is visible so limits are not a surprise.

What you are buying

One control plane for every machine you care about:

No second VPN product. No “upload this folder to a different host” product. No remote-desktop product that cannot also publish. The fleet, the mesh, the tunnels, and the multi-language runtime are the same system.

That is Fabric: every machine you own, one private network, and a place to run the software that sits on them.