Qarvix Documentation

A map of the public Qarvix wiki. The sections below help you find a topic quickly: from connecting your first device to network routes, logs, licensing, and diagnostics.

Wiki map

Start

Quick device onboarding

A step-by-step route for connecting a managed router or a static WireGuard client.

Hardware

Supported hardware

Which devices are already supported and how quickly new hardware is added on OpenWrt.

Schemes

Connection schemes

SIM, router, hub, LAN subnets, cameras, device APIs, sensors, and multiple sites.

Basics

First steps in Qarvix

The shortest path after logging in: organization, network, device, access, and a connectivity check.

Structure

Organizations and networks

How to split clients, branches, teams, networks, and devices along responsibility boundaries.

Access

Users, roles, and SSO

Invitations, roles, 2FA, API tokens, OIDC SSO, and revoking access for staff or contractors.

Nodes

Devices and VPN addresses

Managed devices, static clients, connection tokens, VPN IPs, and statuses.

Networks

Networks, routes, and ACL

Network members, exit node, peer mesh, subnet routes, and access rules between nodes.

Integrations

Device API over the tunnel

Access to local APIs of cameras, PLCs, sensors, meters, and services behind the router.

Oversight

Logs and reports

Action audit, device log, connection events, and material for incident review.

Commercial

Licensing

License principles, limits, renewal, license status, and contractual terms.

Closed network

Offline deployment

Installing and running Qarvix in isolated environments without a permanent internet connection.

Support

Diagnostics and common issues

Checks for WSS, WireGuard, routes, VPN IPs, LAN/API, and access rights.

How Qarvix works under the hood

The diagram below shows the actual technical mechanics of the system: the operator works over HTTPS/REST, the router agent holds a WSS management channel, user traffic runs over WireGuard UDP, and the hub is a WireGuard interface on the controller host.

Actual diagram

Control plane, hub, agent, and static client

The diagram helps keep the control plane and the data plane separate: WSS is for commands, configuration, and agent heartbeats; WireGuard UDP is for encrypted user traffic.

The key point: a managed router holds two links to the same mesh - WSS for commands and configuration, WireGuard for traffic. A static client only has WireGuard, so its online status is determined by the freshness of its handshake at the hub, not by an agent heartbeat.

Multilingual content

This page is in English. It follows the same structure and image paths as the Russian version so both stay in sync as new articles are added.