jadaptive/nodal-community repository overview

⁠Nodal VPN Community Edition

Free, self-hosted WireGuard VPN with built-in 2FA. Unlimited users, devices and networks.

Nodal VPN adds identity and authentication to WireGuard, giving organisations a secure, self-hosted VPN without per-user, per-device or per-network licensing.

Free. Unlimited. No registration. No trial. No expiry.

Nodal VPN⁠ · WireGuard 2FA⁠

⁠WireGuard + Identity + 2FA

WireGuard is deliberately simple. It authenticates peers using cryptographic public keys, but it doesn't provide user identities, passwords or 2FA workflows.

Nodal keeps WireGuard as the underlying VPN technology and adds the identity, authentication and access controls organisations need around it.

⁠Identity

• Active Directory
• Built-in user accounts

⁠Authentication & 2FA

• Google Authenticator
• Microsoft Authenticator
• One-time codes by email or SMS
• YubiKey
• Passkeys
• Duo

⁠Why Nodal VPN?

⁠Free and unlimited

Nodal VPN Community Edition is free to run on your own infrastructure.

• Unlimited users
• Unlimited devices
• Unlimited networks
• No registration
• No trial
• No expiry

Community Edition isn't a time-limited trial or a deliberately restricted version designed to force you into a paid tier.

Deploy it. Use it. Scale it.

⁠Built-in 2FA for WireGuard

Nodal adds an authentication step before VPN access is granted, allowing you to protect WireGuard access with MFA rather than relying solely on possession of a WireGuard private key.

⁠Active Directory integration

Connect Nodal to your existing Active Directory environment and use your existing identities for VPN access.

You don't need to create and maintain a separate directory just for your VPN.

⁠Zero-configuration client model

Nodal manages the WireGuard configuration required by users and devices, removing the need to manually distribute and maintain WireGuard configuration files.

⁠Self-hosted

Run Nodal inside your own infrastructure.

You retain control of your VPN, authentication, identities and network access rather than handing them to another cloud VPN service.

⁠Who is it for?

Nodal VPN is useful for organisations that:

• Want to add 2FA to WireGuard
• Need remote access for Active Directory users
• Want a self-hosted alternative to cloud-managed VPN services
• Don't want per-user or per-device VPN licensing
• Need to manage multiple WireGuard users, devices or networks
• Want the performance and simplicity of WireGuard with identity-aware access control

⁠Docker Setup

Run Nodal VPN Community Edition with MongoDB using Docker Compose.

For downloads, installation guidance and current release information, visit Nodal VPN⁠.

⁠Prerequisites

• Docker
• Docker Compose

⁠Quick Start

Create a docker-compose.yml using the Compose file below and start Nodal:

docker compose -f "docker-compose.yml" up -d

This starts:

• MongoDB 7 with a replica set enabled
• Nodal VPN Community Edition on HTTPS port 56443
• WireGuard on UDP port 51820

Access the Nodal web UI at:

https://localhost:56443

Your browser may display a certificate warning when accessing a new local installation over HTTPS.

⁠Stop

To stop Nodal and MongoDB:

docker compose -f "docker-compose.yml" down

⁠Configuration

Edit docker-compose.yml to change ports or other settings.

Key environment variables for the Nodal container:

The supplied Docker Compose configuration overrides the MongoDB URL so Nodal connects to the MongoDB container using:

mongodb://mongodb:56017

⁠Volumes

Configuration is persisted using Docker volumes so it survives container restarts.

⁠Data Persistence

MongoDB data is stored in the mongodb_data Docker volume.

To reset all data:

docker compose -f "docker-compose.yml" down
docker volume rm nodal-community_mongodb_data

⁠Docker Compose File

services:
  mongodb:
    image: mongo:7
    container_name: nodal-mongodb
    command: ["--replSet", "rs0", "--bind_ip_all", "--port", "56017"]
    networks:
      - nodal-net
    volumes:
      - mongodb_data:/data/db

  mongodb-init:
    image: mongo:7
    container_name: nodal-mongodb-init
    networks:
      - nodal-net
    depends_on:
      - mongodb
    restart: "no"
    entrypoint: >
      bash -c "
        echo 'Waiting for MongoDB to be ready...';
        until mongosh --host mongodb --port 56017 --quiet --eval 'db.runCommand({ping:1})' >/dev/null 2>&1; do
          sleep 1;
        done;
        echo 'Initialising replica set...';
        mongosh --host mongodb --port 56017 --quiet --eval '
          try { rs.status() }
          catch (err) { rs.initiate({_id:\"rs0\",members:[{_id:0,host:\"mongodb:56017\"}]}) }
        ';
        echo 'MongoDB replica set ready.';
        sleep 99999d
      "

  nodal-community:
    image: jadaptive/nodal-community
    container_name: nodal-community
    networks:
      - nodal-net
    ports:
      - "51820:51820/udp"
      - "56443:56443"
    depends_on:
      - mongodb-init
    environment:
      - VPN_HTTPS_SERVER_PORT=56443
      - VPN_MONGODB_URL=mongodb://mongodb:56017
      - VPN_USERSPACE_DRIVER=false
      - VPN_KERNEL_DRIVER=false
      - VPN_WINDOWS_CONNECT_PORT=56222
    volumes:
      - nodal_conf:/opt/nodal-community/conf
      - nodal_conf_d:/opt/nodal-community/conf.d
      - nodal_plugins:/opt/nodal-community/user-plugins      
      - /lib/modules:/lib/modules
      - /dev/net:/dev/net
      - /sys:/sys
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv6.conf.all.forwarding=1

networks:
  nodal-net:

volumes:
  mongodb_data:
  nodal_conf:
  nodal_plugins:
  nodal_conf_d:

⁠Commercial Nodal Editions

Nodal VPN Community Edition is intended to be genuinely useful on its own. You do not need to purchase a commercial edition simply to remove user, device or network limits.

For organisations with additional infrastructure, support, management and governance requirements, Jadaptive also offers commercial Nodal editions.

⁠Nodal Infrastructure

A commercial edition for organisations with additional infrastructure and operational requirements.

⁠Nodal Central

Centralised orchestration and governance for organisations managing Nodal across multiple deployments.

See the Nodal VPN website⁠ for current commercial edition capabilities and licensing.

⁠Documentation & Community

Full documentation is available at:

https://docs.jadaptive.com⁠

Learn more about Nodal VPN:

https://jadaptive.com/nodal-vpn⁠

Learn how Nodal adds identity and multi-factor authentication to WireGuard:

https://jadaptive.com/wireguard-2fa⁠

Questions, feedback and community support:

https://www.reddit.com/r/jadaptive/⁠

⁠More from Jadaptive

Nodal VPN is part of Jadaptive's growing collection of free, self-hosted infrastructure and security software, including:

• Password Express
• Aegis Gateway
• DropPort
• Maverick SSH MCP
• SSH Teams

Explore the Jadaptive Docker Hub namespace to discover more.

The software is the gift. Our expertise is the paywall.

Use it. Scale it. No artificial limits.