GALAXY
Your phone finds the lights. Anywhere.
A phone book and a traffic cop for your devices. Direct peer path when it can. Encrypted relay when firewalls block it. Post quantum (ML-DSA-65) either way.
- Direct first
- End-to-end encrypted
- Works offline at home
- No port forwarding
- ML-DSA-65
Galaxy is the online path. You do not buy it. The lights business pays for it.
A phone book. A traffic cop. That is the whole idea.
Galaxy remembers which app controls which devices, then opens the fastest path between them. Home WiFi? Direct. Café or corporate firewall? Relay. You tap. The lights answer.
Phone book
Knows who your devices are and which app is allowed to talk to them.
IdentityTraffic cop
Tries a direct path first. Relays only when NAT or a firewall blocks it.
PathingCiphertext only
Even on relay, Galaxy sees encrypted noise. Keys stay on your phone and device.
E2EThree steps. Seamless from the phone.
From your phone's view it is one tap. Under the floor, Galaxy picks the path.
Register. App and devices enroll. Each gets an ID. Galaxy remembers the ownership link.
Find. Can they talk directly? Prefer that. If not, open a relay path.
Go. Command arrives. Encrypted the whole way. You never reconnect when the path flips.
Direct when possible. Relay when needed. Always sealed.
Direct first
Most clouds route everything through themselves. Galaxy tries peer path first — millisecond latency, no cloud roundtrip.
Fast pathEnd-to-end
You and the device encrypt before anything leaves. Relays only ever see ciphertext.
Post quantumOffline at home
Same WiFi as the lights? Control them with the internet down. Local never stops.
LANFirewalls just work
No port forwarding. No special router config. Galaxy handles NAT for you.
Zero setupInstant fallback
Direct blocked? Relay takes over automatically. You do not notice.
Always onScales out
One device or a million. Phone fan-out for hundreds. Fleet cue for the rest.
Fleet readyOne tap. A million boards. The phone stays quiet.
Past a few hundred controllers, the phone should not open N sockets. Send one cue. Galaxy fans it out onto each board’s doorbell. Or send the same cue to a gateway you run — it fans out in parallel on your LAN, private addresses only.
Galaxy /v1/fleet/cue
Cloudflare Durable Object tree. Membership tracks with claim. Doorbells ring. Designed for fleet scale over the internet.
Cloudflare Gateway /v1/fleet/cue
Your alienlights-ztna gateway. Parallel HTTP to private WLED hosts. Same cue idea, bytes stay on your network.
Phone fan-out
Still the default under ~500 boards on LAN. Stream.fromFutures. Instant. No hub required.
Zero trust access. Over-the-air flash. At cost.
Galaxy Direct is the post quantum path when you are not on the same network — including signed binary flash. Transit is Cloudflare's published rate (at cost), on all of it. There is no included amount. Nexus transit, bytes your own nodes serve, stays free.
Galaxy Direct
Phone to device over the internet. SSH and desktop tunnels through your gateway. OTA flash of signed bins.
At costNexus transit
Hash-named files on a node you run. Devices fetch with PQ auth. Those bytes are not billed.
FreeWe cannot read the commands. Ownership lives on the device.
Everything is encrypted with keys only you and your device hold. Ownership is cryptographic — proven on the device, not just in a database. Even if Galaxy went dark tomorrow, your devices keep working on local WiFi.
The stack uses audited primitives: encrypted tunnels, direct peer paths with NAT traversal, and an encrypted relay fallback. Your device only accepts commands signed by you. Relays see ciphertext, never plaintext.
- ML-DSA-65
- End-to-end
- Device-held keys
- Local still works offline
Galaxy comes with the lights.
Galaxy is the name for the online features. You do not buy it separately. Download the app, enroll your devices, and the path is there.