Yggdrasil Network Service Hosting - IPv6 Mesh Overlay Setup

Yggdrasil does not provide anonymity in the way Tor does. Your Yggdrasil IP address is cryptographically derived from your public key and is persistent - the same key always produces the same address. Routing in Yggdrasil is source-routed, meaning packet paths are determined by the sending node. Observers on the path can potentially link communicating nodes based on routing patterns.

What Yggdrasil does provide: fully end-to-end encrypted communication between all network participants, resilient mesh routing that works through NAT and partial network outages, and a persistent addressable identity that does not require DNS or centralized infrastructure. These properties make Yggdrasil useful for building private overlay networks, distributed applications, and encrypted communication infrastructure, but not for anonymous publishing or accessing the public internet anonymously.

Think of Yggdrasil as a tool for building a private internet among trusted participants, while Tor is a tool for accessing any internet resource anonymously. They serve different purposes and are often complementary rather than competing.

Install Yggdrasil from the official packages:

apt install -y gnupg2 curl
curl -so - https://pgp.neilalexander.dev/neilalexander.cer | gpg --dearmor > /usr/share/keyrings/yggdrasil-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/yggdrasil-keyring.gpg] http://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/ debian yggdrasil" | tee /etc/apt/sources.list.d/yggdrasil.list
apt update && apt install yggdrasil

Generate initial configuration: yggdrasil -genconf > /etc/yggdrasil/yggdrasil.conf. Edit the configuration to add peers - at least one peer address is needed to join the global Yggdrasil network. Public peer addresses are listed at yggdrasil-network.github.io/services/peers. Add 2 to 3 geographically close peers in the Peers section of the config.

Start Yggdrasil: systemctl enable --now yggdrasil. Verify connectivity: yggdrasilctl getself. The output shows your 200-series IPv6 address that is persistent to your key. Test connectivity to another Yggdrasil node with ping6 or curl over the Yggdrasil address.

Services accessible on Yggdrasil bind to the Yggdrasil IP address or to all interfaces. Since Yggdrasil uses a specific IPv6 prefix (200::/7), you can bind services to this prefix specifically while leaving them inaccessible on clearnet IPv4 or IPv6:

# nginx listening on Yggdrasil IPv6 address only
server {
    listen [YOUR_YGGDRASIL_IPv6]:80;
    # ... configuration
}

Users who are connected to Yggdrasil can reach your service directly through your Yggdrasil IPv6 address without going through any proxy or exit node. The connection is fully encrypted end-to-end but not anonymous - your service's Yggdrasil address is known to anyone you share it with and routing metadata is potentially observable.

Yggdrasil hosting is most appropriate for: private collaboration networks among trusted participants, Tor infrastructure management (using Yggdrasil for secure management access to Tor servers without exposing management ports to the clearnet), and experimental overlay network applications. It is not a replacement for Tor for public-facing anonymous services.