How rizomanet works

A guide for members, for the people who look after the computers that run it, and for anyone curious. For the short version of what this is and why, see about.

Contents: using it · your data · nodes · how changes travel · how nodes agree · security · running a node · what's built · software

Using it

Membership is by invitation. A member can invite people they know; an admin then accepts them. Invites from admins let people straight in.

• Places are pieces of land: a farm, an orchard, a garden, woodland. A place can have several hosts.
• Actions are work days with a date: what needs doing, how many people, what to bring, what's provided. You sign up, and can leave a note for the hosts.
• Jobs are a place's to-do list without a fixed date. You offer to help, and the hosts get in touch.
• People have a profile: skills, availability, area, pronouns, organisations, dietary needs, and ways to be contacted, in order of preference.
• Network: you can say you have met someone in person. Once they confirm it, it shows on both profiles. It helps everyone see who knows whom.
• Map: places and upcoming actions, on OpenStreetMap.

Everyone agrees to the community guidelines and terms when they join, and again when they change.

Your data

• Only members see anything. Nothing is public except the about, privacy and this page.
• Contact details (phone, contact email, notes) are shown either to all members or only to people you're connected with, as you choose. Connected means: co-hosts of a place, hosts of a place where you signed up or offered help, and people you have both confirmed meeting.
• Dietary needs can include allergies, which count as health information. They are shown only to people who can see your contact details, so hosts can cook for you.
• Photos are re-encoded when uploaded. This removes hidden data such as where a photo was taken.
• No tracking. No analytics or advertising, and only two cookies: one keeps you logged in, one protects forms.
• Your rights: Account → Download my data gives you everything stored about you. Account → Delete account removes it. The deletion travels to every node (see below), and the deleted data is overwritten in the database file, not just hidden.

Read the full privacy notice.

One network, several nodes

There is no central server. The network runs on a few small computers, called nodes, at different farms. Each node holds a full copy of the network and serves this website to anyone nearby, on the farm's Wi‑Fi.

   Farm A               Farm B               Farm C
   node ◄──internet──►  node ◄──internet──►  node
     ▲                    ▲
     └────USB stick───────┘    (and later: radio)

   phones and laptops on each farm's Wi‑Fi
   use their farm's node like any website

Why do it this way:

• It keeps working when the internet doesn't. On a farm whose connection is down, people can still browse, sign up and post. The node catches up with the others later.
• Nobody owns it. No single company, server or person can switch it off or read everything from outside.
• It suits the land. Rural connections come and go, so the network is built to expect that.

Each node has its own random id and its own key. Records (people, places, actions…) get random 16-digit numbers, so two nodes never give the same number to different things.

How changes travel

Every node keeps track of which records changed, and when. It doesn't keep old copies of the data, just a note of what changed. To bring another node up to date, it packs the changes into a bundle: one file, encrypted with the network's secret and signed with the node's own key. A bundle can travel any way you like:

• USB stick (working now). Plug a stick into a node and wait half a minute: the node takes in everything on the stick, then leaves one bundle with everything it knows. Carry the stick to the next node and repeat. Every node the stick visits gets all the news, and the news it adds travels on. No screen or clicking needed, once a stick has been chosen for syncing (see below). A lost stick reveals nothing: everything on it is encrypted.
• Internet (next to build). Nodes will send bundles to each other directly whenever they can reach each other. An always-on node on a rented server can act as a meeting point.
• Radio (planned). LoRa radio links between farms, with Reticulum, for small urgent changes when there's no internet. Radio is slow, so photos wait for the internet or a stick.

It doesn't matter which way changes arrive, in what order, or how many times. Every node ends up with the same data once the changes have reached it.

How nodes agree

Two nodes that were apart can both have changes. They agree using simple rules, which every node applies the same way:

• Each field keeps its newest value. If you change your phone number at one farm and your bio at another, both changes are kept. If the same field was changed in both places, the later change wins.
• A deletion wins over changes made without knowing about it. If a work day is cancelled and deleted at one farm while someone signs up for it at another, the work day and the sign-up both disappear everywhere. Deleted things don't come back from an old copy.
• Things that depended on something deleted go too. For example, sign-ups for a deleted work day. A link to a deleted person ("created by") is cleared, and the rest stays.
• Duplicates are kept apart, and admins are told. If the same login email is used for two new accounts at two nodes, both accounts stay. The newer one's login email is changed to start with "duplicate-", and an admin should ask the person which to keep. Two organisations with the same name are kept apart the same way: the newer one gets a number added to its name.

Times come from a "hybrid clock": the computer's clock, corrected so it never goes backwards, which matters on computers that start without the right time. A node whose clock is more than a day ahead is turned away until its clock is fixed.

Security

• Passwords are stored only as a slow one-way hash (scrypt). Weak and common passwords are refused. You can log out of all your devices from your account page.
• Logins stay on one node. Your password works on every node, but a login session belongs to the node where you logged in.
• Network secret: one secret, given in person, that every node knows. Bundles and photos are encrypted with it (AES‑256‑GCM). Without it, a bundle is unreadable noise.
• Node keys: each node signs its bundles with its own key (Ed25519). Other nodes remember a node's key the first time they see it and refuse anything later that claims to be that node with a different key. Fingerprints can be compared in person.
• A lost or stolen node: block it on the other nodes, then replace the network secret (see below).

Running a node

Any small Linux computer will do: a Raspberry Pi 4 or 5 with an SSD (rather than an SD card), a mini PC, or an old laptop. Use a small UPS if the power is unreliable.

git clone <repository> rizomanet && cd rizomanet
./start.sh            first time: asks a few questions, then starts
./start.sh service    run it in the background, start on boot

Give each node a name in .env, for example NODE_NAME=Greenwood. Everything else is done from the web, by an admin, under Admin → Sync. A phone on the farm's Wi‑Fi is enough.

1. Start the network on the first node: Start a new network. It shows the network secret: write it down, or copy it.
2. Join on every other node: paste the secret into Join a network. Give the secret in person, never by email or chat.
3. Choose a stick: plug a USB stick into a node. It appears on the Sync page: choose Use this stick for syncing. This adds a rizomanet folder to it and leaves everything else on the stick alone. Any ordinary stick will do.
4. From then on, that stick syncs by itself whenever it is plugged into any node of the network. Plug it in, wait half a minute, unplug it, take it to the next node. The Sync page shows what each stick brought and took, but nobody needs to look.

A new node starts empty: join the network, then plug in a stick that has been to another node. It gets everything.

If a node is lost or stolen: on each remaining node, block it under Other nodes, then Leave the network. One node starts a new network and the others join the new secret.

If a node was reinstalled, it has a new key, and the others refuse its news until an admin chooses forget its key.

Technical notes: sticks are looked for under /media, /run/media and /mnt. A computer with a desktop that is logged in mounts sticks there by itself. On a node without a desktop (such as Raspberry Pi OS Lite), run ./start.sh usb once. Everything on the Sync page can also be done in a terminal:

npm run sync -- status            this node, the others, recent syncs
npm run sync -- init              start a network (first node)
npm run sync -- join <secret>     join it (other nodes)
npm run sync -- usb /media/you/STICK
npm run sync -- block <node id>   (also: unblock, forget, leave)

Backups: every node is a copy, but keep a backup anyway. Stop the service and copy the data folder, or see the README. The data folder also holds the node's key and the network secret, so keep backups as safe as the node itself.

What's built, and what's next

1. Done: the website: places, actions, jobs, people, the "met in person" network, invitations, guidelines, privacy tools.
2. Done: a database ready for syncing: random ids, change tracking, deletions that really delete.
3. Done: the sync engine: bundles, merge rules and USB sticks, tested with several nodes passing a stick around.
4. Done: syncing without a terminal: set up from the web, and sticks that sync by themselves when plugged in.
5. Next: syncing over the internet, directly between nodes.
6. Then: radio links (Reticulum over LoRa), a pilot with 3–4 farms, and a ready-made install for new nodes.

Software

Free and open source (AGPL‑3.0): anyone can use, study, change and share it, as long as changes stay open too. It is built with Node.js, Express and SQLite, with maps from OpenStreetMap and Leaflet, and is small enough to run on a Raspberry Pi. There is no tracking. The font and the map code are served by each node itself; only the map images come from OpenStreetMap's servers.