Start with one node: three daemons. Then how one of them enforces what was paid for, how customers pay it, how gates pay on behalf of devices with no TollGate software, and finally the libraries underneath and the ways it all gets deployed: one router, a mesh exit, a whole fleet.
The protocol never touches money, so the daemon that speaks it holds none. Pricing lives in the market, so merchantd can be swapped or moved without touching delivery. Issuing is the one power that needs guarding, so mintd does nothing else. Each has a terminal dashboard: tolltop, minttop, merchanttop.
tollgated is one generic daemon, never a special build. Each job is a named instance with its own config, ports, identity and sockets in /run/tollgate-<name>/. What an instance decides (an access level and a rate per peer) is carried out by its enforcer.
ipGates, shapes and meters each peer on the Linux kernel's forwarding path, by source address.
fipsHands the same decisions to a FIPS node, for peers identified by their mesh key.
externalHands them to another program over the enforcer protocol on a Unix socket. exitd is one.
loopbackShapes a socket of its own. Runs anywhere, including macOS; used for tests and demos.
A TollGate is meant to be used by running TollGate. The customer's node pays the gateway itself, hop by hop, and a router can resell what it buys.
For phones, browsers and sandboxed agents. Each device gets one real TollGate client session, keyed by its address and dialled from it (IP_TRANSPARENT), so the gateway treats it as any other peer. The proxy never carries the phone's data.
The protocol prices nothing: one voucher buys one byte, and what a byte costs in sats is settled in the market. A gate can now sell only pay for what you use (portal.accumulative_only) and serve an operator's own theme (portal.theme_dir). The rule itself is worked through on Paying for it.
Read it bottom up: each layer builds on the one beneath it, and every arrow points at what it uses. tollgate-core never does I/O and knows nothing about networks: it would meter watt-hours or litres the same way. tollgate-net is what makes it about bytes. The suite and the fleet add no protocol of their own.
tollgate-rs on its own: build it, depend on the crates, or install a package. Buy, sell, or both.
The tollgate-suite package: all six tollgate-rs binaries plus proxyd, each with a procd init script. Guest Wi-Fi, portal, speeds.
exitd and a second tollgated instance sell internet to the mesh, on the router (fips-exit-setup) or any Linux server (make linux).
Many routers as plain access points, bridged over FIPS to one NixOS gateway. Phones roam and keep what they paid. How it works
| Repository | Holds | State |
|---|---|---|
tollgate-rs | The protocol and its design docs; tollgate-protocol, tollgate-core, tollgate-net with tollgated, mintd, merchantd, their dashboards and the client | v0.1.0-rc.2 · tested between real nodes |
tollgate-suite-wrt | The tollgate-suite library, proxyd, exitd, the OpenWrt and Linux packages; built against a pinned tollgate-rs commit | v0.1.0-rc.2 · host-tested, not yet on a router |
tollgate-fleet | The NixOS gateway module, the fleet command, the router agent and image builds, a Grafana dashboard | v0.1.0 in development · not yet on hardware |
tollgate-net-esp32 | A node for constrained devices on the same tollgate-core, with its own wallet and enforcer | separate project |
Before this stack: TollGate v1, a Go module for OpenWrt (tollgate-module-basic-go) gating by MAC address with NoDogSplash, shipped in TollGate OS and listed on the release explorer. The Rust stack replaces it with Spilman channels, per-node byte mints and a resource-agnostic core.
tolltop --instance ipthe LAN's payers, budgets and ratesminttopthe mint: keysets, issued and redeemedmerchanttopthe market: sales, prices, holdings/etc/init.d/tollgated instanceseach instance, its config and socketslogread -e tollgate-ipone instance's logfips-exit-setupturn the FIPS exit onfleet statusevery router in a fleetmakebuild the suite against TOLLGATE_RS_REV