Sovereignty & data flows
Node64 runs with you. Your data stays in your network, and everything Node64 exchanges with ipv64.net stays in Germany. This page lists honestly and completely which outgoing connections exist, when they happen – and where you decide yourself.
- Local first: database, settings, measurements, logs and keys live on your node. Node64 also runs without internet and without an account.
- ipv64.net is German: it is operated by Prox IT UG in Mülheim an der Ruhr, and the servers are hosted by Hetzner in Germany, in Falkenstein and Nuremberg. Health checks probe from Nuremberg and Falkenstein, and the CDN64 edge servers are in Germany too. The GDPR applies.
- No telemetry: Node64 sends no usage data. Checking for new versions is off by default.
- You choose third-party services: DNS upstream, certificate authority and notification channels – with European or self-hosted alternatives.
Why it matters
Many homelab tools depend on services outside Europe: tunnels via US providers, monitoring from the cloud, push services with servers abroad. Node64 takes the other route. What happens in your home network stays there. What comes online on top – outside checks, publishing without port forwarding, DynDNS, certificates for ipv64 domains, the community blocklist – runs via ipv64.net in Germany.
- CDN64 instead of a US tunnel: publish services without port forwarding via edge servers in Germany. In mode 1 the connection stays encrypted all the way to your node.
- Outside checks from Germany: online and hybrid checks measure from Nuremberg and Falkenstein.
- Notifications via ipv64: e-mail and SMS via ipv64.net – without your own mail server and without a push service abroad.
- Certificates via ipv64 DNS: Let's Encrypt via DNS-01 for ipv64 domains, without credentials at a third-party DNS provider.
- Honeypot reports: go exclusively to ipv64.net. Never content from real logs, only IP, kind and count.
All outgoing connections
Node64 only opens connections when you use the respective feature. Inbound, only what you open yourself is reachable (web interface, PROXY64, DNS64, honeypot traps).
| Destination | Purpose | When | Where |
|---|---|---|---|
| ipv64.net (API v2, health check sync) | DynDNS, online checks, portal, certificates for ipv64 domains, mail and SMS, honeypot reports, early warning, node overview | only with an API key or link | Germany (Hetzner, Falkenstein and Nuremberg) |
| ipv64.net (lists, IP detection) | blocklists and country lists for PROXY64, country data for Honeypot64 (instead of a third-party GeoIP database), detecting the public IP | when PROXY64 lists or DynDNS are used | Germany (Hetzner, Falkenstein and Nuremberg) |
| CDN64 edge servers | tunnel for services without port forwarding | only with CDN64 | Germany (Hetzner, Falkenstein and Nuremberg) |
| Cluster nodes | syncing several nodes | only in a cluster | your own nodes |
| DNS upstream | resolving names DNS64 doesn't have cached – always encrypted | with DNS64 | by default Cloudflare (USA), Quad9 (Switzerland) and dnsforge (Germany) – German and EU templates with one click |
| Blocklist sources | downloading lists for DNS64 (download only, no data from you) | with DNS64 | the lists' project sites, incl. GitHub and GitLab |
| Public DNS resolvers | check whether the TXT record for a DNS-01 certificate is visible (only that record is queried) | only for DNS-01 certificates | Cloudflare, Quad9, Google, DNS4EU, dnsforge, AdGuard, Mullvad – your own resolvers can be set |
| Certificate authority | Let's Encrypt or ZeroSSL via ACME | only for public certificates | Let's Encrypt: USA – alternatives |
| Notification channels | your alerts | only configured channels | depends on the channel – alternatives |
| Targets of your checks | health checks | as configured | your services |
| ipv64.net (version file) | checking for new versions without sending data | only when switched on (off by default) | Germany (Hetzner, Falkenstein and Nuremberg) |
| GitHub Container Registry | pulling the Docker image | on install and update | GitHub (USA) |
Where you decide
DNS upstream
DNS64 only queries the internet encrypted (DoH, DoT or DoQ). Cloudflare, Quad9 and dnsforge (servers only in Germany) are set by default. To stay entirely in Europe, switch Cloudflare off under DNS64 → Settings and use European templates: dnsforge, Freifunk München and Digitalcourage from Germany or DNS4EU (co-funded by the EU) – each unfiltered, since DNS64 filters itself. Quad9 (a foundation in Switzerland), Mullvad (Sweden) or your own resolver work too. Details under DNS64.
Certificates
Publicly trusted certificates come from an ACME certificate authority such as Let's Encrypt. In the home network you often don't need that: the certificate store has its own CA, and you can upload your own certificates.
Notifications
Self-hosted: e-mail via your mail server, ntfy or Gotify on your own server, webhook, browser. From Germany: e-mail and SMS via ipv64.net. Matrix with your own homeserver works too. Telegram, Discord, Slack, Microsoft Teams and Pushover are services outside the EU – use them only if you want to. More under Notifications.
Without internet at all
Health checks in your home network, PROXY64 with its own CA, DNS64 for local names and from the cache, the cluster between your nodes and Honeypot64 without reporting also run without any outgoing connection. If the internet is gone, the node keeps measuring and catches up on alerts and data later.
What is stored at ipv64.net
Only what you enable a feature for: checks and measurements for linked health checks, domains and IPs for DynDNS, names and tunnels for CDN64, honeypot reports if you switch them on. With an API key, also the node's name, location, version and modules for the node overview. You can unlink at any time; Reset node deregisters the node at ipv64 first. What linking brings exactly is described under Connect ipv64.net.
Questions about sovereignty and privacy are welcome in the v64.tech forum.
Something unclear, missing, or a question about Node64? Ask in the official forum v64.tech.
