The mesh grows by independent operators running their own relay hosts — not by this project centralizing more servers. Every host runs the same no-logs onion-routing code, free or paid tier, so more of them means a genuinely stronger anonymity guarantee for everyone, not just more capacity.

Multi-hop circuits split trust across entry/middle/exit hosts (WHITEPAPER §7) — but that guarantee only means something if the hosts in a circuit are actually run by different, diverse operators. A mesh with a handful of hosts under one or two operators is honestly weaker than Tor, and this project says so plainly (WHITEPAPER §14) rather than implying otherwise. The single biggest thing anyone can do to improve the real anonymity guarantee here is run another independent host. Circuit diversity selection already prefers spreading hops across different operators/ASNs (`diversity.go`) — it just needs more of them to choose from.

Running a node also earns contribution credit toward hosting costs (MONETIZATION.md §5.5) based on uptime and, if you opt in, storage capacity offered for file-share replication.

• A Linux box (VPS or bare-metal) you control — Ubuntu/Debian assumed by the install scripts, other distros work if you install the equivalent packages by hand.
• A public IP, reachable at whatever ports you open (the relay port, plus the WireGuard UDP port if you also offer direct VPN service).
• Docker (easiest path) — or Go 1.22+ for a bare-metal systemd deployment.
• That's it. No account with this site, no payment, no approval needed up front unless this deployment's operator has manual approval turned on (see below).

Fastest path — Docker, onion-relay only (no direct VPN service, just circuit relaying — the lighter-weight way to help). No published image — build it from the project source, same as this deployment does:

git clone <this project's source> tintedsand && cd tintedsand
docker build -t tintedsand-mesh-host -f mesh-host/Dockerfile .
docker run -d --name tintedsand-relay \
  -p 9443:9443 \
  -v tintedsand-relay-data:/data \
  tintedsand-mesh-host \
  -addr=:9443 \
  -endpoint=<your-public-ip-or-domain>:9443 \
  -broker=http://127.0.0.1:8443 \
  -data-dir=/data \
  -role=any \
  -operator="<your name or org, for circuit diversity>"

Also offer direct WireGuard VPN service (the Mullvad-style host list other users self-serve a config from at /connect) — add -vpn -vpn-endpoint=<ip>:51820 -vpn-provision-url=http://<ip>:9080/vpn/provision and run it via mesh-host/vpn-entrypoint.sh so a real wg0 comes up first — see mesh-host/README.md's "VPN host list" section for the full flag reference.

Prefer bare-metal / no Docker? installer/bootstrap.sh does host hardening (SSH, firewall, unattended upgrades) and installer/wg-keygen.sh sets up the WireGuard side, then run mesh-host as a systemd unit — see installer/README.md.

Your host registers itself the first time it starts — it generates its own long-term keypair, proves possession of it to the broker via a signed challenge/response, and starts heartbeating. No invite code or credential needed from this site to do that part.

What happens next depends on how this deployment's operator has configured their broker:

• Auto-approve is on — you're live immediately, and should show up on /nodes within a heartbeat interval or two.
• Manual approval is on — your registration sits pending until the operator runs broker -approve-host <your pubkey>. Check the log output your mesh-host process prints on startup for your pubkey, and reach out to the operator to get approved.

Either way, confirm you're actually in the mesh at /nodes— it's a live mirror of the broker's signed directory, the same one every client verifies before trusting it.