Documentation
Your security tools stay where they are. When an app validates, deploys or checks drift on a self-managed server, domain or IP, Veltrix has to reach it first. Connectivity providers describe how: over a mesh VPN, an SSH key, a tunnel, or a cloud session service. You configure each provider once, and every installed app can use it; apps never build their own SSH or VPN plumbing.
There are two related pages under Settings, and they are easy to confuse:
| Page | Route | Purpose |
|---|---|---|
| Connectivity (ZTNA) | /settings/connectivity | Bring your own network path: enter the credentials of a provider you already run (Tailscale, WireGuard, SSH, and so on). |
| Remote Access | /settings/remote-access | Link servers to a Veltrix-operated Tailscale network with a one-time install command. Requires platform enablement; see below. |
Both pages are for organization administrators. Other users receive an authorization error from the page.
The Connectivity (ZTNA) page is titled Remote Connectivity. It shows one card per provider type, grouped by category, with a count of how many providers you have configured. Each card has a description and a footer button: Configure the first time, Add Another afterwards. You can keep several configurations of the same type, for example two Tailscale tailnets.
| Icon | Action |
|---|---|
| Wi-Fi | Test connection. Records the outcome and the test date. |
| Star | Set as default. There is one default per organization across all provider types; setting a new one clears the old. |
| Gear | Edit configuration. Change the name or fields. Secret fields show a masked value; leave them untouched to keep the stored secret, or type a new one to replace it. Default is changed with the star, not in this dialog. |
| Trash | Remove configuration. Confirmation: “This cannot be undone.” |
When you edit a provider, the dialog also has a Test Connection button that shows the result inline; it tests the configuration already saved, so save changes first. Refresh at the top reloads the list.
| Status | Meaning |
|---|---|
| Not configured | The provider type has no configuration yet. |
| Configured | Saved; not yet tested. |
| Connected | The last test passed. |
| Error | The last test failed; the message is printed under the card. |
For the managed provider only, Available and Unreachable are shown in place of Configured and Error.
All secret fields (marked below) are encrypted at rest and masked when read back.
| Provider (category) | Fields | What Test does |
|---|---|---|
| Tailscale (Mesh VPN) | Tailnet Name*, API Key* (secret, a Tailscale API access token tskey-api-...; device auth keys and OAuth client secrets are rejected), API URL (optional) | Live call to the Tailscale API. The API URL must be an HTTPS address on api.tailscale.com; self-hosted Headscale is not supported. |
| WireGuard (Mesh VPN) | Private Key* (secret), Peer Public Key*, Endpoint* (host:port), Allowed IPs* (comma-separated CIDRs), DNS Servers, Preshared Key (secret) | Configuration validation only. |
| ZeroTier (Mesh VPN) | Network ID*, API Token* (secret), Node ID | Live call to ZeroTier Central for the network. |
| Nebula (Mesh VPN) | CA Certificate*, Node Certificate*, Node Key* (secret), Lighthouse Host*, Lighthouse Port (default 4242), Lighthouse Nebula IP* | Configuration validation only. |
| Cloudflare Tunnel (Zero Trust) | Tunnel Token* (secret), Account ID*, Tunnel ID, API Token (secret) | Configuration validation only. |
| HashiCorp Boundary (Zero Trust) | Boundary Address*, Auth Method ID*, Login Name*, Password* (secret) or a pre-issued Auth Token (secret), Scope ID | Live check that the controller is reachable and the auth method exists; credential rejection is reported. |
| SSH Keys (Traditional) | Host*, Username*, Private Key* (secret), Key Passphrase (secret), SSH Port (default 22), Jump Host, Jump Host Port, Jump Host Username | Configuration validation only. |
| OpenVPN (Traditional) | Server Address*, Port (default 1194), Protocol (UDP/TCP), CA Certificate*, Client Certificate, Client Key (secret), TLS Auth Key (secret), Username, Password (secret) | Configuration validation only. |
| AWS Systems Manager (Cloud Native) | AWS Region* (ten regions listed), Access Key ID*, Secret Access Key* (secret), Session Token (secret), Assume Role ARN | Live STS identity check with the supplied credentials in the chosen region. |
| Veltrix-managed ZTNA (Managed) | None | Checks that the managed tailnet is reachable. See below. |
Providers marked “configuration validation only” are tested for completeness, not for a working tunnel. A green Connected status means the settings are well formed, not that Veltrix has proven it can reach your network. Verify end to end with a validation run or a small deployment.
When an app deploys, it receives the provider that fits the target component and decrypts credentials only at that moment. See App Development and the SDK Reference if you are building an app that needs connectivity.
A card titled Managed by Veltrix (“Zero-config Tailscale, run by Veltrix”) appears on the Connectivity page only while a platform administrator has published the managed offering. When it is published it is added to your organization automatically and is read-only: you cannot configure, edit or delete it. The only action is Test. The card shows the tailnet and the tenant tag when known, a Default star if it is your default, and the last test time. Without publication the card is hidden entirely, which is the normal state today.
Requires platform enablement. Remote Access depends on a Veltrix-operated Tailscale network that the platform operator must set up and connect. It is not generally available. If it has not been enabled for the platform, the page shows Remote Access is not available — Your Veltrix administrator has not enabled managed remote access yet. Please contact support to turn it on for your organization. and none of the controls below appear.
When enabled, the page Remote Access lets you link your own Linux servers to the Veltrix network. Each server joins tagged for your organization, and network access rules isolate it from every other tenant.
| Column | Meaning |
|---|---|
| Server | Hostname (or device name) and its first network address. |
| OS | Operating system the device reports. |
| Status | Online or Offline. |
| Last seen | Last time the device checked in. |
Remove deletes the device from the network after confirmation; it loses remote connectivity until enrolled again.
Every install command you generate is listed with its label, status, created time and expiry.
| Status | Meaning |
|---|---|
| PENDING | Key issued; the server has not joined yet. |
| ACTIVE | A server with the matching label has joined. |
| EXPIRED | The key lifetime passed without use. |
| REVOKED | You cancelled it. |
Revoke is offered on PENDING and ACTIVE rows: a server that has not yet joined with that key will no longer be able to. Revoking an enrollment also revokes the underlying key but never removes a device that already joined; use Remove for that.
Once servers are linked and the managed provider is published, pick Veltrix-managed ZTNA wherever an app asks for a connectivity method.