# Private network

> Every FadeHost account comes with its own private network: a WireGuard-encrypted mesh that connects everything you host with us, and optionally your own...

Source: https://fadehost.com/docs/private-network/

Every FadeHost account comes with its own **private network**: a WireGuard-encrypted mesh that connects everything you host with us, and optionally your own devices. Members reach each other **by name**, traffic never touches the public internet, and nothing on the network is reachable by other customers or from outside.

Find it under **Private network** in your control panel.

## What's on it

Your network activates automatically with the first thing worth reaching privately:

| Member | Joins |
|---|---|
| **Databases** | Immediately when created: the private hostname (like `db-abc123`) lives here |
| **VPS** | Immediately when provisioned: the whole machine becomes a member |
| **Discord bots** | On their next start |
| **Game servers** | On their next start |
| **Your devices** | Whenever you connect them (see below) |

Game servers and bots join lazily: if one was already running when your network came to life, restart it once and the private names will resolve from inside it.

## Connecting your own device

Join your laptop or PC and everything above becomes reachable from it: query your database from your IDE, SSH into your VPS on its private address, all without exposing anything publicly.

1. Open **Private network** in the panel and click **Create a join key**. Keys are single-use and only work for your network.
2. Install the open-source [Tailscale client](https://tailscale.com/download) on your device (Linux: `curl -fsSL https://tailscale.com/install.sh | sh`).
3. Run the command the panel gives you. It points the client at FadeHost's coordination server with your key.

The device appears in your panel list once connected. While connected, your private names (database hosts, your VPS) resolve automatically. Disconnect anytime with `tailscale down`; remove a device for good from the panel.

## Addresses and names

Every member gets a stable private address in the `100.64.0.0/10` range and a name:

- Databases: `db-<id>`, the host you put in your app's config
- VPS: the hostname you chose at provisioning
- Game servers: `srv-<id>`
- Bots: `bot-<id>`

Short names resolve from any member. If a short name doesn't resolve somewhere, the full form `<name>.fh.internal` always does.

## Security model

- **Isolation is per-account.** Your network and every other customer's are separate namespaces. Other tenants cannot see your members at all.
- **Private-only by default.** A database with public access disabled accepts connections *only* from your network members.
- **Player traffic is unaffected.** Game traffic rides your server's public address as usual; the private network is for your services talking to each other.

## Troubleshooting

- **A name doesn't resolve inside a game server or bot:** restart it once; members join on start.
- **Your device can't connect:** join keys are single-use; mint a fresh one from the panel.
- **You removed a device by accident:** just create a new key and join again.

Anything else, open a ticket. FadeHost support answers fast.