A fleet in WireHop is just your private network of machines (a warren), managed at scale: roles and tags across every machine, replicated to all of them, with no master server. Same WireHop simplicity, from 5 machines to 5,000.
Managing a fleet comes down to your warren, tags, and roles.
Your machines, as one shared list. Every node sees the same membership; there's no master server to run or lose. Add a machine and it's in the warren; its roles and tags travel with it.
Label your hosts with tags like developer, production, or web. Tags describe what a machine is.
Define what people can reach. A role maps to host tags ("developers reach developer + staging machines") and gates warren VPN reach too. Each person gets their own account.
Set up fleet management in four steps.
Install WireHop on any machine. It starts your warren and prints a creator invite. Redeem it from your laptop with hop connect and it's saved as a known host (here, myserver).
Roles map host tags to access, and to warren VPN reach. Manage any host remotely with hop admin <host>, e.g. hop admin rex role create developer.
One invite registers any number of machines into the warren, with their tags. Membership replicates to every node, no master list to keep in sync.
Invite people by role. They reach every matching machine (by name, over the warren) each with their own account.
Define who can access what. Each role maps to host tags and access settings.
Roles default to individual accounts with no sudo. Override as needed, give ops sudo, create shared service accounts for CI, or add users to specific Unix groups.
roles.json, version-control your access policyRestrict what peers can do at the OS level. Policies are enforced via macOS Seatbelt and Linux Landlock.
Sandbox policies flow through three layers: role definition (the role sets the baseline), invite creation (the host can further restrict), and client connection (the client can self-restrict). The result is always the strictest combination.
monitor (read-only, no network, scoped paths), audit (read-only, no network), deploy (scoped write, dangerous commands blocked)--read-only, --no-network, --scope, --allow-commandroles.jsonOnce set up, your team works with the warren using familiar commands.
The same fan-out you just saw, asked for in plain language instead of typed.
Add WireHop to your AI tool and it can select machines by role or tag and run one command across all of them, then bring the output back together. It skips machines that are offline and tells you how many it skipped, so a partial answer never looks like a complete one.
No infrastructure to manage. The same tool works at every size.
Your warren plus JSON config, zero infrastructure beyond WireHop itself. Set up in minutes.
Same warren. Roles keep access organized, and membership replicates to every node automatically, nothing to keep in sync by hand.
No central server to bottleneck or shard: the warren replicates peer-to-peer, and data flows directly between machines.
Fleet features are built into WireHop: it's just your warren at scale. Install the daemon, redeem the creator invite, and you're managing every machine.