Local Services & Mesh DNS

Run the 0Trust control plane and edge services on your laptop. The services VPI stub listens on 127.0.0.1:5354 and resolves private mesh names (.mesh, .social, .tunnel) through the platform authoritative nameservice on UDP :53. All other queries fall back to public DNS (8.8.8.8).

Architecture

•

platform.exe — IdP, registry, PKI, authoritative NS (:53), HTTPS :8443

•

services.exe — VPI stub (:5354), optional WAN edge (:8080)

•

Query path: resolver → 127.0.0.1:5354 → 127.0.0.1:53 (private) or 8.8.8.8 (public)

Prerequisites

•

Go 1.25+ and the 0TrustCloud repo

•

Build binaries: .\build.ps1 (or go build ./cmd/platform and ./cmd/services)

•

Config file: config/services-local.yaml (shipped in the repo)

Terminal 1 — platform

cd C:\Users\you\0TrustCloud
$env:TRUST_DATA_DIR = "data"
.\bin\platform.exe config\config.yaml

Wait for [nameservice] authoritative DNS listening and 0Trust.Cloud ONLINE. Default HTTP listen is :8443 (config server.port / http_only).

Terminal 2 — services

cd C:\Users\you\0TrustCloud
$env:TRUST_DATA_DIR = "data"
.\bin\services.exe -config config\services-local.yaml

Look for [vpi] private DNS stub listening on UDP 127.0.0.1:5354. services-local.yaml sets upstream_ns to 127.0.0.1:53 (platform wire_port) and disables ACME / privileged :443.

services-local.yaml

mode: server
vpi:
  enabled: true
  stub_listen: "127.0.0.1:5354"
  upstream_ns: "127.0.0.1:53"
  fallback_ns: "8.8.8.8:53"
  private_suffixes: [".mesh", ".social", ".tunnel"]
tunnel:
  public_port: "8080"
  control_enabled: false

Verify mesh resolution

Use dig against port 5354 (not 53). Git Bash, WSL, or Linux/macOS:

dig @127.0.0.1 -p 5354 social NS +short
dig @127.0.0.1 -p 5354 wiliwaw.social A +short
dig @127.0.0.1 -p 5354 app.wiliwaw.social A +short
dig @127.0.0.1 -p 5354 tunneltug.tunnel A +short
dig @127.0.0.1 -p 5354 google.com A +short

Private zones should return answers from the local platform registry. google.com should resolve via the public fallback.

Health checks

curl -sk https://127.0.0.1:8080/_0trust/health
curl -s  http://127.0.0.1:8443/api/v1/vpi/status

CLI-only VPI stub

If you only need DNS resolution (no WAN edge), run the mesh client stub after platform is up:

.\bin\0trust.exe vpi stub --upstream 127.0.0.1:53 --listen 127.0.0.1:5354

Windows notes

•

Do not run taskkill /IM services.exe — that targets the Windows Services process. Stop 0Trust services by PID: Get-NetUDPEndpoint -LocalAddress 127.0.0.1 | Where-Object LocalPort -eq 5354

•

Always query the VPI stub on port 5354. Port 53 is the platform authoritative server, not the developer stub.

•

If the stub times out, confirm platform is listening on :53 and services-local.yaml upstream_ns is 127.0.0.1:53 (not :5353).

Production edge

On droplets, services-server.yaml runs the same VPI stub (127.0.0.1:5354 → 127.0.0.1:53) beside ACME ingress and vhosts. See deploy/RUNBOOK.md for two-droplet layout and zone sync.