PLATFORM

Alien Lights Development Platform

Alien Lights makes lighting, and that is what we primarily sell. The development platform is what we built to run it, and you can run your own things on it: post-quantum identity, secure remote access, a message queue, signed firmware and packages, and a private VPN. One suite, one price.

See pricingSign up nowOverview

No military. No spying. No corporate espionage. No copying other companies' patented products. No suppressing activists. Read the terms.

Pricing in one minute

Full pricing, tables and examples

The gateway and the Alien VPN exit run on machines you own, so you pay for that hardware and network yourself. The pricing page says how users, domains, and transit are billed. Galaxy Direct has no included amount.

Before you try Alien VPN

Your corporation must run its own gateway to connect to anything other than Auto connect. Auto connect is the default: it shows which Cloudflare edge you reach and how it is performing, and it carries nothing. The full device tunnel carries all of a phone's traffic, and it only connects through a gateway and exit that your own corporation operates. Alien Lights does not operate an exit.

Everything in the platform

Where each part stands

We say what works and what does not. Available means it runs today and we have tested it. In development means it is written and tested in pieces but not shipped. The full device tunnel still needs a gateway and exit your corporation runs. The detailed status table is on the overview.

Start

1. Read the pricing, then sign up. Your company address is free. Two users are included, then $10 a month each. A domain you bring is $10 a month.
2. Install the gateway and agent from the package repositories and follow Set it up.
3. Sign your rules, then reach your devices with alienlights-ztna ssh, desktop and vpn check.

Making WLED devices or IoT lighting? That is our vertical and it pays for the platform. Start at Build the Future, or see Alien Lights.

One suite. Post-quantum from the device to the cloud.

The platform is zero trust access, device management, mail, a message queue and identity, built on one post-quantum identity layer. Your company owns its data end to end and holds the keys. We make it post-quantum and carry it across Cloudflare's global network. Production mail is free at you@company.alienlights.net. Development mail is free at you@company.dev.alienlights.net. A domain you bring is $10 a month through Stripe, on either. Two users are included, then $10 a month each. Galaxy Direct is the over-the-internet path. Nexus transit is free. alienlights.net is the root.

Sign up nowSee pricing

Making WLED devices or IoT lighting? That is our vertical and it pays for the platform. Start at Build the Future. See the field of use.

Also in the suite

Galaxy remote accessNexus syncThreat intelligenceOpen firmware securityIdentityEquity

Where each part stands

Zero Trust Access Available

Alien Zero Trust replaces a corporate VPN or Cloudflare Zero Trust for the services you expose: SSH, databases, internal tools. There are three parts. A gateway that you deploy. An agent on each device that dials out, so the device opens no inbound port. A client your people run. Policy is a rule set you sign. The gateway syncs it from our API and checks the signatures before it applies a single rule.

Run the gateway as a Nexus node

Post-quantum transit is Nexus plus nodes that you host, and it is one flag on the gateway: alienlights-ztna gateway run --nexus. The same process that enforces your rules now also keeps your signed firmware and packages on your own machine, named by SHA-256. Your devices fetch from it. Every request is signed with the caller's ML-DSA-65 identity and checked against your signed rule set: your owner identity writes, enrolled devices read. Bytes that do not match their name are refused, and bytes your node serves are Nexus transit, which is free. The over-the-internet path is Galaxy Direct: post-quantum zero trust and over-the-air binary flash, billed at Cloudflare's published rate (at cost). See how it fits the pricing.

It is a cache of signed artifacts, not a place for secrets. Relaying Nexus device sync through your own nodes, and devices finding the nearest node on their own, are planned.

Cloudflare in front, free

The gateway needs one public hostname. Put it behind a Cloudflare Tunnel and Cloudflare's network, DNS and DDoS absorption sit in front of it. A tunnel config template is installed with the package at /usr/share/doc/alienlights-ztna/gateway-cloudflare-tunnel.yml.example.

Pro is meant to add a managed hostname with Cloudflare DDoS and bot mitigation in front of it. That managed hostname is not built yet. Today you set the tunnel up in your own Cloudflare account.

Set it up

Install alienlights-ztna from the apt or yum repository, then:

# owner, once
alienlights-ztna enroll --name "owner"
alienlights-ztna org create --name "Acme"       # prints a gateway token, keeps org.json (your decryption key)
alienlights-ztna rules init > policy.json       # edit it, then:
alienlights-ztna rules publish policy.json

# gateway host
sudo alienlights-ztna enroll --dir /var/lib/alienlights-ztna/gateway --name "gw-1"
echo '{"listen":":8443","token":"zt_..."}' | sudo tee /var/lib/alienlights-ztna/gateway/gateway.json
sudo systemctl enable --now alienlights-gateway

# device
sudo alienlights-ztna enroll --dir /var/lib/alienlights-ztna/agent --name "$(hostname)"
sudo systemctl enable --now alienlights-agent

alienlights-ztna devices                              # what you may reach
alienlights-ztna ssh pi@DEVICE                        # SSH through the tunnel (name or id)
alienlights-ztna desktop DEVICE --protocol rdp        # Windows Remote Desktop on a loopback port
alienlights-ztna desktop DEVICE --protocol vnc        # macOS Screen Sharing or a Linux VNC server
alienlights-ztna exec DEVICE pkg.list
alienlights-ztna metrics                              # decrypted on your machine

Keep org.json safe. It holds the key that decrypts your metrics and logs. Alien Lights cannot recover it.

SSH and remote desktop for Windows, macOS and Linux Available

The device owner turns on what a machine offers. The people allowed to use it are named in your signed rules. Every connection is its own tunnel, authenticated with ML-DSA-65 on both ends, so a proxy in the middle cannot pose as the gateway or the person.

# on the device (Windows, macOS or Linux)
alienlights-ztna agent run --ssh            # OpenSSH on 127.0.0.1:22
alienlights-ztna agent run --rdp            # Windows Remote Desktop on 127.0.0.1:3389
alienlights-ztna agent run --vnc            # macOS Screen Sharing or a Linux VNC server on 127.0.0.1:5900
alienlights-ztna agent run --service db=127.0.0.1:5432   # any other TCP service

# in your rules: who may open which service on which device
{"effect":"allow","principals":["group:ops"],"devices":["tag:lab"],"actions":["tunnel:ssh","tunnel:rdp"]}

The agent builds for Windows, macOS and Linux from the same source. On Windows and macOS it offers remote access and signed commands. Package management and the metrics report are Linux features for now. Remote desktop uses the viewer on your own computer.

Alien VPN: the full device tunnel Exit builds from source Android app in development

Auto connect and the full device tunnel are the two modes of Alien VPN. Auto connect needs nothing from you: it shows the Cloudflare edge you reach and how it is performing, and it does not carry your traffic anywhere. The full device tunnel sends every packet the phone sends, IPv4, IPv6 and DNS, through one post-quantum tunnel to an exit your corporation runs, so websites see your exit's address and your private network is reachable as if you were in the office.

Your corporation must run its own gateway to connect to anything other than Auto connect. Alien Lights does not operate an exit for the full device tunnel. Without a gateway of your own there is nothing for it to connect to.

# on a machine in your network: this is the exit (no root, no TUN device, no firewall changes)
# build from source for now: cd ztna && go build ./cmd/alienlights-ztna
alienlights-ztna agent run --vpn-exit
alienlights-ztna agent run --vpn-exit --vpn-dns 10.0.0.2:53 --vpn-deny 10.99.0.0/16

# in your rules: who may use the exit
{"effect":"allow","principals":["group:staff"],"devices":["tag:exit"],"actions":["tunnel:vpn"]}

# check it from your laptop: tunnel, DNS and a TCP connection, all through the exit
alienlights-ztna vpn check office-exit

Honest limits. The --vpn-exit flag and vpn check are in the source tree and ship in the next package release; the published 0.4.0 packages do not have them yet. Android only for now: Windows, macOS and Linux have vpn check but no system-wide tunnel yet. Ping (ICMP) is not carried. It carries TCP and UDP. The exit is a general internet exit for the people your rules name, so run it where you would run any corporate egress, and keep the prohibited uses in mind. The exit is tested end to end through a gateway. The Android part is compiled and its logic is tested, but we have not run it on a phone yet.

The 3D connection map In development

We are building a Flutter app that draws your gateways, devices and live tunnels as a 3D force-directed graph. It reuses the 3D graph engine behind our live infrastructure page, so you can see that visualization working today on public data. The app is not released yet. Until it is, alienlights-ztna devices lists what you can reach.

What it does not do

Alien Zero Trust carries TCP services between an authenticated person and an authenticated device, and, through an exit you run, a phone's whole traffic. It does not filter DNS or HTTP, and it does not isolate browsers. If you rely on those parts of Cloudflare Zero Trust, keep them.

System on a Chip Available

A Raspberry Pi, a Jetson, a BeagleBone or any other Linux board is a computer. So it is managed like one, through apt or dnf. Install a package, enrol the device, and your company can reach it and manage its packages. Boards that cannot run Linux go through PlatformIO instead, on the Microcontrollers tab.

Bring a device under management

sudo apt install alienlights-soc
sudo alienlights-ztna enroll --dir /var/lib/alienlights-ztna/agent --name "$(hostname)"
sudo tee /var/lib/alienlights-ztna/agent/agent.json <<'J'
{"gateway_url":"https://gw.example.com","gateway_id":"GATEWAY-UUID",
 "services":{"ssh":"127.0.0.1:22"}}
J
sudo systemctl enable --now alienlights-agent

Add the device's UUID to devices in your policy and publish it. Then, from your own machine:

alienlights-ztna exec DEVICE pkg.list
alienlights-ztna exec DEVICE pkg.upgrade
alienlights-ztna metrics

The packages

Signed packages for Debian and Ubuntu (apt) and for RHEL, Fedora, Rocky and Alma (dnf or yum), built for amd64, arm64 and armhf.

Debian and Ubuntu

curl -fsSL https://alienlights.net/alienlights-repo.asc \
  | sudo gpg --dearmor -o /usr/share/keyrings/alienlights.gpg
echo "deb [signed-by=/usr/share/keyrings/alienlights.gpg] https://alienlights.net/packages/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/alienlights.list
sudo apt update
sudo apt install alienlights-soc

RHEL, Fedora, Rocky, Alma

sudo curl -fsSL -o /etc/yum.repos.d/alienlights.repo https://alienlights.net/packages/alienlights.repo
sudo dnf install alienlights-soc        # or: sudo yum install alienlights-soc

Two ways to manage a device

Verify what you install

The apt repository is signed (InRelease), the yum metadata is signed (repomd.xml.asc) and every RPM carries its own signature. One key signs all of it. Check the fingerprint against this page before you trust it:

curl -fsSL https://alienlights.net/alienlights-repo.asc | gpg --show-keys --with-fingerprint
# Alien Lights Packages <packages@alienlights.net>
# B462 2542 77D8 7044 920F  9D03 4206 3C53 9773 C1E1

Microcontrollers: signed firmware with PlatformIO

Secure firmware should not be a release-day chore. The PlatformIO plugin hooks into pio run, so every build of every board is measured, stamped, hashed and signed the same way, from the first prototype to the production image. It is one Python file and one line in platformio.ini.

Add it to a project

[env:esp32dev]
platform = espressif32
board = esp32dev
framework = arduino
extra_scripts = post:/usr/share/alienlights/platformio/alienlights.py
custom_alien_version = 0.15.1
custom_alien_max_bytes = auto
custom_alien_require_signing = yes
custom_alien_require_clean = yes
custom_alien_publish_dir = dist/firmware

Build and sign

export ALIEN_SIGNING_KEY=~/keys/firmware-signing.key
pio run -e esp32dev
pio run -e esp32dev -t alien_verify
pio run -e esp32dev -t alien_publish

Key: a 32-byte ML-DSA-65 seed. The private key is never written into the image. With a key set, the plugin also writes the ML-DSA-65 public key for on-device verification.

What a build prints

Output of a real build for an ESP32 with the Arduino framework.

Building .pio/build/esp32dev/firmware.bin
Successfully created ESP32 image.
alien: firmware.bin  291632 bytes  sha256 1b0cb7d5cf4e74c8
alien: signed ml-dsa-65  key 7d9e053168ab7f94
alien: size budget 291632 / 1900544 bytes (15.3%)
========================= [SUCCESS] Took 66.16 seconds =========================

.pio/build/esp32dev/
  firmware.bin                 the image you flash
  firmware.bin.sig             3309-byte ml-dsa-65 signature
  firmware.bin.sha512          sha512sum-format hash
  firmware.bin.manifest.json   version, board, git, size, hashes, key fingerprint

Know what is running

void setup() {
  Serial.begin(115200);
  Serial.printf("fw %s (%s) built from %s signed=%d\n",
                ALIEN_FW_VERSION, ALIEN_BOARD, ALIEN_GIT_SHA, ALIEN_BUILD_SIGNED);
}

When something goes wrong, it stops

alien: ERROR: firmware is 15960 bytes, over the custom_alien_max_bytes budget of 10000 (over by 5960)
alien: ERROR: custom_alien_require_signing is on but no signing key is set (export ALIEN_SIGNING_KEY=/path/to/key.pem)
alien: ERROR: signature does NOT match program

The signature format is the one the Alien Lights OTA flow already uses: firmware.bin, firmware.bin.sig and firmware.bin.sha512, verified on the device against the embedded public key before anything is flashed. The plugin works with any PlatformIO board or framework that produces a binary; for other output files, such as .hex or .uf2, point custom_alien_artifact or custom_alien_artifacts at the files. The package ships pq_identity.mjs and @noble/post-quantum next to the plugin so identity minting works offline. It is included in Starter and Pro alike, and signing never touches the network.

Source: tools/platformio/alienlights.py · install path: /usr/share/alienlights/platformio/

Post-quantum identity and secure updates

The PlatformIO plugin above gives every build a signature you can check, and a post-quantum identity of its own. It mints an ML-DSA-65 key, writes the public key and a device id into alien_pq_identity.h, and records them in the manifest. The seed stays in .alien/device-identity.json on the machine that built the image. Set custom_alien_embed_pq_seed = yes only for a one-device image you flash yourself and do not publish: that copy of the seed is then inside the binary. Available

Two separate projects go further. The Factory writes firmware with a unique post-quantum identity for any PlatformIO project, and does it for up to 40 boards at a time from one Raspberry Pi. See the Factory tab. A separate WLED project handles secure over-the-air updates for WLED, so a malicious binary pushed to a device is refused. Separate project

What is not built here yet: connecting Factory-issued identities to this gateway so microcontrollers report sealed metrics the way Linux devices do. Planned A board running Linux should use the System on a Chip path instead.

Factory: one secure root, a post-quantum fleet Separate project

The Factory is where a fleet gets its identity. It is a scale-out k3s cluster built for Raspberry Pi, provisioned with Ansible, that writes firmware with a unique post-quantum identity for each device and works with any PlatformIO project. Start a fleet here and every device has a post-quantum identity from its first boot. It is a separate project from the packages on this page. It was tested on the Raspberry Pi 4B.

The chain of trust

Security here comes from where the chain starts. The Factory is the root. Everything below it is only as trustworthy as the first link.

1. Start at the root. One secure Factory holds the signing keys and makes the images and the firmware.
2. Sign what it makes. Hardened SoC images and microcontroller binaries are signed. Each device is given its own post-quantum identity.
3. Accept only what is signed. A device takes an update only if it is signed by the root. This is the job of the WLED project for WLED over-the-air updates, and of the signed builds from the PlatformIO plugin.
4. Recognise each other by identity. Devices, hosts and people prove who they are with post-quantum signatures, in the gateway and in Alien Queue.
5. Watch the edge. Alien Antivirus checks images, runs a honeypot for attackers and links what it catches to botnet intelligence.

Start from the root, or reflash

A device that began life with unsigned firmware cannot prove anything about itself, so the chain cannot be added to it from outside. There are two ways to be inside the chain:

What this does not promise

We do not call this invincible, because nothing is. A fleet that starts at the root has no way to be updated with an unsigned binary, which closes the malicious over-the-air update path. These are still yours to handle:

The Factory is described here from its author's own testing on the Raspberry Pi 4B. It is not shipped in the apt and yum packages, and the images and charts are not published on this site yet.

Alien Antivirus Available

Alien Antivirus checks files against definitions we sign, on your machine. It scans Android apps and firmware images, and it can run a honeypot that looks like the unauthenticated update page on WLED and similar firmware, so attackers show their hand. It is part of the gateway package, so it is on every System on a Chip, Security Operations and suite install.

Install and run it

sudo apt install alienlights-ztna    # also in alienlights-soc, -secops and -suite
alienlights-av update                 # fetch the signed definitions and verify both signatures
alienlights-av info
alienlights-av scan ~/Downloads       # exits 1 on a detection
alienlights-av scan --adb             # third-party apps on a phone connected with adb
alienlights-av fwcheck app.bin --key fleet.pub.pem

sudo systemctl enable --now alienlights-av-update.timer
sudo systemctl enable --now alienlights-honeypot.service   # the decoy

"No match" means the definitions do not know the file. It does not mean the file is safe.

How it fits with secure updates

Alien Antivirus does not make a device refuse a bad update. That is the signed firmware path: the Factory, the PlatformIO plugin and the WLED project, which accept only signed binaries. Alien Antivirus is the other half: it catches attackers who try, shows where they came from, and links them to botnet operations. Devices that were not started from the Factory's root need reflashing before they can refuse an unsigned update.

Where each part stands

Included in every plan. There is no separate price.

Security Operations Available

For the analysts and engineers who run a security operations center. Install alienlights-secops on an analyst or SIEM host and you get the CLI, the zero trust gateway and user tools, and the threat intel feed.

The first five minutes

sudo apt install alienlights-secops    # or: sudo dnf install alienlights-secops
alienlights doctor                                   # checks the install and the hosted services
alienlights signup --name "secops-01"                # free identity, saved to ~/.config/alienlights/identity.json (mode 600)
sudo systemctl enable --now alienlights-intel.timer  # hourly threat intel sync
alienlights intel show                               # campaigns and attack chains from the last sync
journalctl -t alienlights-intel -o json              # the same records, for your forwarder

Feeds are read from public endpoints and nothing is uploaded from your machine. Add the repository first, from the System on a Chip tab.

SOC here means security operations center. This is a toolkit for the people who run one. It is not a SOC 2 report and it is not an audited product, and the packages say so in their README.

Alien Queue Available

A publish/subscribe message queue built on the same ideas as mail: sealed, signed, and unreadable to the service that carries it. Topics are split into partitions. Consumers in a group share a committed offset and can replay from the start. A device or a service produces. Another consumes. It is a relay for your traffic and not an archive: the service holds ciphertext only for the retention you set, up to 30 days. Keep your own copy in your own storage.

Try it

sudo apt install alienlights-mq      # or: sudo dnf install alienlights-mq
alienlights-ztna enroll --name "producer-01"   # an identity, once per machine
alienlights-mq init --org org_... --owner OWNER-UUID

# the owner creates the topic and grants its key to the members
alienlights-mq topic create telemetry --partitions 2 --retention 24h \
  --producers PRODUCER-UUID --consumers CONSUMER-UUID

alienlights-mq produce telemetry --key sensor-1 "temp=61.5" "temp=62.0"
alienlights-mq consume telemetry --group dashboards --commit --follow

A person who is not on the topic gets "topic not found". A consumer that tries to produce is refused before anything is sent.

What we can and cannot see

Compared with Kafka

Alien Queue is a stand-in for the way you use Kafka, not a drop-in for its protocol. Kafka clients and Kafka Connect cannot talk to it today. You use alienlights-mq or the Go package behind it. Ordering is per partition, and records with the same key land in the same partition within one key epoch. A key rotation can send the same key to a different partition afterwards.

Limits today: 100 topics per organisation, 256 members per topic, 100 records or 1 MB per produce call, 256 KB per record.

Your Data Available

Your corporation owns its data, end to end. We do not store it, so we do not bill for storing it. It lives where you put it: in your own cloud provider, on your own servers, or cached on your own nodes. What the platform does is the transit. We make the movement of that data post-quantum, tie every transfer to a device identity and a user identity, and carry it across Cloudflare's global network.

What works today

The zero trust gateway carries any TCP service between an authenticated person and an authenticated device. Point a service at a self-hosted S3-compatible store such as MinIO or Ceph and your people reach it by identity, with nothing exposed to the internet:

{"gateway_url":"https://gw.example.com","gateway_id":"GATEWAY-UUID",
 "services":{"ssh":"127.0.0.1:22","objects":"127.0.0.1:9000"}}

alienlights-ztna connect DEVICE objects --listen 127.0.0.1:19000
# then point any S3 client at http://127.0.0.1:19000

What is not built yet

Starlink IoT Available

A pump station, a weather mast or a fleet vehicle on Starlink is a hard place to run a VPN. Standard Starlink service commonly sits behind carrier-grade NAT, so you cannot forward a port to the device, and the link comes and goes. Alien Zero Trust was built for this. The device agent only ever dials out, so there is nothing to forward and nothing to open.

Set up a remote site

sudo apt install alienlights-soc
sudo alienlights-ztna enroll --dir /var/lib/alienlights-ztna/agent --name "pump-station-7"
sudo tee /var/lib/alienlights-ztna/agent/agent.json <<'J'
{"gateway_url":"https://gw.example.com","gateway_id":"GATEWAY-UUID",
 "telemetry_interval_seconds":900,
 "services":{"ssh":"127.0.0.1:22"}}
J
sudo systemctl enable --now alienlights-agent

A Raspberry Pi, Jetson or other Linux board on the dish's network does the job. Boards that cannot run Linux sit behind it and are programmed through PlatformIO.

What is not built yet

Alien Lights is not affiliated with or endorsed by Starlink or SpaceX, and Starlink is their trademark. We have not yet tested the agent on Starlink hardware. It works the same way on any link that allows outbound connections.

Bring your own OAuth, or use ours for free

You should not have to move your users to adopt a security suite. The suite works with the OAuth and OpenID Connect provider you already run, and if you do not run one, Alien Lights is a free one.

$ alienlights oauth check --issuer https://accounts.google.com
issuer         https://accounts.google.com
result         OK
authorization  https://accounts.google.com/o/oauth2/v2/auth
jwks_uri       https://www.googleapis.com/oauth2/v3/certs
token          https://oauth2.googleapis.com/token
userinfo       https://openidconnect.googleapis.com/v1/userinfo
jwks keys      1

issuer      https://alienlights.net/api/identity
discovery   https://alienlights.net/api/identity/.well-known/openid-configuration
authorize   https://alienlights.net/api/identity/oauth/authorize
token       https://alienlights.net/api/identity/oauth/token
userinfo    https://alienlights.net/api/identity/oauth/userinfo
jwks        https://alienlights.net/api/identity/oauth/jwks.json

One identity for everything else

The identity you sign up with is the same one that enrols devices, signs rule sets, produces to Alien Queue and signs you in. Each identity holds its own ML-DSA-65 key pair on your side, and every change to it lands in a public Merkle transparency log. Read how identity works →

Equity Available

One ring per Corp, included free with the platform. There is no extra charge and no platform fee. Your percent of the company is your percent of the profit, paid every month. Paying in and taking out go through Stripe, and the person moving the money pays Stripe's fee.

You see your own stake. A Corp admin sees that Corp's book, and Alien Lights admins are root. Buying equity is a PDF you sign. Equity for work is a PDF the admin issues, with a number of months before it can be sold. The value of a holding follows the latest funding round.

Open equity

Consultation

The first hour is free. After that, consultation is $100 an hour, paid on this page. We meet on Zoom.

The first consultation includes a free website and a setup demonstration. Please have your SoC or microcontroller dev board with you, or purchase one from us.

We provide simple website builds and a preview, and we show you how to build your site with Cursor. That is free on the first visit. Each website after that is $100 and comes with a free follow-up one-hour consultation.

Book the free hour

Pay for more

Each paid website includes a free one-hour follow-up. The website on the first visit is already included.

Bring your own company.

Alien Lights is one company, and alienlights.net is the root. Everyone else brings their own.

Every company gets two free addresses:

• Production: you@yourcompany.alienlights.net
• Development: you@yourcompany.dev.alienlights.net

A domain you already own is a custom domain at $10 per domain per month, billed through Stripe. You can attach one to production, to development, or to both.

• Two users are included. Each additional user is $10 per month.
• Devices are unlimited.
• There is no storage charge, because we do not store your data.

Equity is one ring per Corp and adds nothing to the bill.

We do not resell Cloudflare. The platform is our own post-quantum zero trust, with our own identity, gateway, agent and message queue. It rides Cloudflare's network. You open no Cloudflare account and get no Cloudflare invoice from them. Galaxy Direct transit on your bill is Cloudflare's published rate (at cost).

Galaxy Direct is post-quantum zero trust network access over the internet, including over-the-air binary flash. Your phone reaches a device on that path, and a signed bin is flashed on that path. Galaxy Direct transit is Cloudflare's published rate (at cost), on all of it. There is no included amount. Nexus transit is free. Bytes your own nodes serve never cross our network, so they are not billed.

Post-quantum transit: Nexus plus your own nodes

Post-quantum transit is Nexus plus nodes that you host. One flag on the zero trust gateway makes it a Nexus node on your own machines:

alienlights-ztna gateway run --nexus --nexus-max-gb 20
alienlights-ztna nexus push app.bin --node https://gw.example.com

The node keeps signed firmware and packages, named by their SHA-256. Your devices fetch from it, and every request is signed with the caller's ML-DSA-65 identity and checked against your own signed rule set. A node stores bytes only if they hash to the name, and clients check the hash again on download, so a node cannot pass off other bytes as your firmware. It can pull what it is missing from an origin once, then serve the rest of the fleet itself. That is Nexus transit, and Nexus transit is free. The same bytes fetched over the internet, through Galaxy Direct, are Cloudflare's published rate (at cost).

Be straight about what this buys. Transit is already cheap, as the tables below show, so a node will not change your bill much. What it gives you is control: your bytes move over your own hardware, on your own network, even with no internet. A node serves signed artifacts, not secrets: seal anything confidential before you store it. Traffic is protected by TLS 1.3. Go offers the hybrid X25519MLKEM768 key exchange by default, so give the node a certificate with --tls-cert to have it end to end. Behind a proxy or a tunnel, the proxy's TLS applies.

The doorbell: why a million devices cost almost nothing to keep reachable

Each device keeps one idle WebSocket open to its own object on the network, the doorbell. While the device is idle, keep-alive pings are answered by the network itself and cost nothing. Nothing runs and nothing is billed. The object wakes only when a device connects or when you ring it, for example to say an update is ready. Then the device downloads the signed bin once. That is why a big fleet stays cheap.

That is why devices are unlimited. A user is a person, not a device. Galaxy Direct bills all of the WebSocket and transit usage at Cloudflare's published rate (at cost). There is no included amount, and the doorbell keeps that usage small. Users over the two included are a flat $10 a month, not a charge per device.

The table below is a fleet that gets an 8 MB signed bin every 6 months, with each device reconnecting 30 times a month. Every figure is a month.

These figures are Galaxy Direct transit only. A domain you bring is $10 a month. Two users are included, then $10 a month each, on yourcompany.alienlights.net as well. Development mail, you@yourcompany.dev.alienlights.net, is free too. On Galaxy Direct, bins are served from object storage with no egress charge, so 1,000,000 devices taking an 8 MB bin is 8 TB per update at no data-transfer cost. The same bin served by your Nexus node is free. Rounded to the cent.

What can move these numbers

The assumption that matters most is how often devices drop and reconnect. Each reconnect wakes the device's object. A healthy fleet sits near the 30 a month used above. A fleet on a bad link can be many times that. This is 1,000,000 devices:

Not in these numbers: sealed metrics, the encrypted reports devices send to your organisation. They are priced separately, kept for 30 days, and capped per organisation. A very large fleet reporting often should send metrics to its own pipeline instead, and use the doorbell and Nexus for what they are good at.

The rates

The transit lines are Galaxy Direct, over the internet. You pay Cloudflare's published rate (at cost) on all of it. There is no included amount. Nexus transit is free. Cents are rounded half up, line by line. What your own cloud provider charges you to store your data is between you and them.

How a bill is worked out

1. Two users or fewer, on company.alienlights.net or company.dev.alienlights.net, and no Galaxy Direct transit? The bill is $0.00.
2. More than two users? $10 a month for each user past the two included.
3. Bringing your own domains? $10 a month for each domain.
4. Galaxy Direct transit? Multiply all of the usage on each line by the rate you pay. There is no included amount and no base fee.
5. Nexus? Transit your own nodes serve is free.

Try your own numbers

What real usage costs

The calculator counts domains, users over 2, and Galaxy Direct Worker requests and CPU time. It does not model the doorbell, which is in the fleet table above, or sealed metrics. Nexus transit is free and is not added.

Field of use: IoT lighting and WLED derivatives

IoT lighting is our vertical, and it pays for this platform. The platform is for everything else you build and run. So the Services are not licensed to anyone to compete with Alien Lights in that field. By signing up you agree to this:

1. The restricted field. Designing, making, selling or operating connected or addressable lighting products or services, or firmware that is a fork or derivative of WLED, for other people.
2. What you agree not to do. While you use the Services, and for 12 months after you stop, you will not use the platform, or anything you got through it (the gateway, Alien Queue, the Factory, signed images, the doorbell, Nexus, Galaxy), to build or run a business in the restricted field.
3. What is always fine. Managing your own lighting, such as the lights in your own buildings, venues or vehicles. Building anything outside the restricted field. Using WLED itself. This does not limit anyone's rights under the WLED open-source licence. It limits what you do with our services.
4. Want to build in this field anyway? Do it with us. The Build the Future page explains how: build inside the Alien Lights ecosystem and share in the profit, or build your own company with us as the foundation. Without a written agreement, the restriction applies.
5. If a court says part of this is too broad, it is cut back to what the law allows. The rest stays. This restriction does not apply where the law of your place does not allow it.

If you make WLED devices or lighting products, start at Build the Future.

Prohibited uses: no military, spying, corporate espionage, patent copying or suppression of activists

Alien Lights and the services behind it (mail, the gateway, Galaxy, Alien Queue, Nexus, Alien Poke, Alien VPN, the Factory and signed images) exist to protect people. They may not be used against them, or to take what other people have built. By signing up, or by installing or using the apps or agents, you agree to this:

1. No military use. Military means military, in the ordinary sense of the word. You will not use the Services, or anything you got through them, for any military purpose of any kind. That covers armed forces, military intelligence, defence ministries and the contractors and suppliers working for them; combat, defence, logistics, training, communications and weapons work alike; and any country, ally or cause. It does not matter whether the use is offensive or defensive, large or small, or paid or free. There are no exceptions.
2. No spying. Spying means spying, in the ordinary sense of the word: secretly watching people or organisations, or secretly collecting, intercepting or tracking information about them. You will not do it with the Services, whoever you are: a government, an intelligence or security service, a company, or an individual. That covers espionage, covert monitoring, stalkerware, and surveillance of anyone who has not been clearly told. There are no exceptions for any customer, country or cause. Openly managing devices you own, where the people using them know, is not secret and is not spying.
3. No corporate espionage. Corporate espionage is spying on a company. You will not use the Services to steal, obtain or leak another company's trade secrets, confidential information, source code, designs or customer data, or to get into its systems or people's accounts without permission. This is part of the ban on spying and has no exceptions either.
4. No copying of patented products. You will not use the Services to copy another company's patented product, or to design, make, sell or run anything that infringes another company's patent. That includes using the platform to reverse engineer a product in order to copy it, to build or distribute the copy, or to manage a business that sells it. Making your own product, building something different, and using what you hold a licence for are fine. So is using an invention whose patent has expired or been held invalid.
5. No suppression of activists. You will not use the Services to identify, locate, monitor, intimidate, harass, silence, detain or retaliate against activists, journalists, human rights defenders, dissidents, protesters or others for their lawful speech, reporting, organising or beliefs.
6. What happens if you do. We may suspend or revoke your identity and organisation, refuse service, and remove your access to signed packages and queues, without notice and without a refund. We will not read your sealed data to decide this, because we cannot. We act on what is shown to us: reports, public facts, and your own account activity.
7. Reporting. If you believe the Services are being used this way, tell us through the contact on the privacy page. Do not include anyone's secrets.
8. These terms travel. They apply to anyone you give access to, and to anything you build on the Services for others. They apply even where another licence covers parts of the software, because this limits what you do with our hosted services and signing keys, not anyone's rights in open-source code.
9. If a court says part of this is too broad, it is cut back to what the law allows. The rest stays. This does not apply where the law of your place does not allow it.

Get the app →  ·  Read the docs →