Rivet

An OpenVPN control plane for restricted IoT and edge networks. Rivet provides a REST API, web UI, and private VPN agent for client certificates, fixed addresses, routes, and controlled access between VPN peers.

Install

Both deployment options use an unprivileged API and a separate privileged agent on Linux. OpenVPN continues forwarding traffic during an API outage.

The API command is rivet; the agent command is rivet-agent. Do not install the unrelated PyPI package rivet. Installing a wheel alone does not provision OpenVPN or the browser UI; follow the complete installation guide.

Builds and deployments are provider-independent. The supplied authenticated API/UI configuration uses Microsoft Entra ID. Azure Blob Storage is optional. SQLite is the reference database; extras support MySQL and PostgreSQL. See configuration and production deployment for identity, HTTPS, network, and release requirements.

Package/image publication and deployment acceptance requirements are tracked in release readiness.

Use

Start with the user guide to register clients, assign addresses, distribute credentials, and manage restricted networks. A device AccessGrant controls application visibility; a restricted network controls VPN traffic. They are separate policies.

The API exposes its schema at /openapi.json and interactive reference at /docs (under /api through Nginx). Management calls require the appropriate verified permission. See API authorization and agent mapping.

For existing VPN installations, use the migration toolkit. Whole-application backups use the backup and recovery section.

Develop

See local development for Python setup, the authenticated API/agent stack, and isolated UI testing. Frontend commands and implementation conventions live in frontend/README.md.

From an environment with requirements-dev.txt installed:

ruff format --check .
ruff check .
mypy .
pytest --cov=src/sciaiot/rivet --cov-report=term-missing

Ordinary tests mock privileged operations and cloud services. Live VPN tests are explicitly invoked on disposable Linux infrastructure; see the integration harness guide.

The documentation index links current operational and engineering references, including the architecture.