TurboFabric path model

TurboFabric picks one path per peer pair. Selection is ranked: direct first, then datacenter gateways, then relay only when explicitly permitted. A datacenter gateway is a routed peer — not the same class as an unrelated relay.

What a datacenter is — a logical routing domain a server may belong to several of, with a priority and a trusted flag — lives on Datacenter networks. This page assumes it.

The control plane stamps diagnostics-only paths[] on each GET fabric relay (peerServerId, selected, optional endpoint / viaServerId / lastHandshakeAt / latencyMs, degraded). That summary is never hashed into desired reconcile state.

Six path states

Selection contract

1. Prefer a healthy direct path (direct_lan, then direct_public). direct_lan only considers datacenters both peers are pinned into and that are marked trusted; when there is more than one, they are tried in (priority asc, id asc) order. An untrusted shared datacenter is skipped as if the pair did not share it.
2. Try NAT direct (direct_nat) when a public/LAN endpoint is not enough. NAT rendezvous is already implemented in the control plane (turbopanel/src/lib/fabric/rendezvous.ts) and applied on the daemon with kernel-only probes (wg set … endpoint + wg show dump — never a userspace STUN socket). Arbitrary symmetric NAT is not guaranteed to punch.
3. Fall back to a datacenter gateway (gateway) — typically leaf → gateway → gateway → leaf across sites. The same trust filter and (priority asc, id asc) ordering decide which of a leaf's datacenters supplies its gateway when it belongs to several.
4. Use relay only when org (and relay) allowRelay permits it.
5. Otherwise the pair is unreachable.

allowRelay policy

• Organization allowRelay defaults false (opt-in / degraded). PUT /organizations/:id/fabric may set it alongside enabled.
• Relay allowRelay is null (inherit org), true, or false. A relay may only tighten org policy: effective = orgAllowRelay AND (relayAllowRelay ?? true). A relay cannot turn relay on when the org has it off.
• GET fabric returns both the stored override and effectiveAllowRelay.
• preferredGatewayIds must reference gateway-role relays in the same fabric (422 preferred_gateway_invalid otherwise).

Relay copy in the console: Relay is a degraded fallback path and must be explicitly enabled. A datacenter gateway is not the same as an unrelated relay.

Related

• Datacenter networks
• Managed database ingress
• Network addressing