Private overlay

The overlay is the reason High exists: every component you run, wherever it runs, joins one private per-tenant network and talks as if on a single LAN.

One private network

When an outpost enrolls, it joins your tenant's overlay. From then on, components address each other by stable private names regardless of physical location — your API on EKS reaches your database on a Pi at home over the overlay, encrypted, without exposing either to the public internet.

How it reaches everywhere

The overlay is an encrypted WireGuard mesh. Each outpost gets a stable address on your network the moment it enrolls, and traffic between components is encrypted end to end and takes the most direct path it can — even across clouds, NATs, and home connections. You don't configure any of it: no VPNs to stand up, no firewall rules to reconcile, no public IPs to hand out.

Isolation

The overlay is per-tenant. Your network is yours alone; there is no shared address space between tenants, and nothing is reachable across that boundary. Reaching a service in another tenant is deliberate and granted, never ambient — see Sharing services. Public exposure is opt-in and explicit — see Routes & ingress.