Topologies
Sanctum modes
| Mode | Use case | Description |
|---|---|---|
| Tunnel | Site-to-site & roadwarrior | When connecting different sites, or client to sites. This mode is also used for cathedral clients, where peer discovery happens automatically. |
| Pilgrim-shrine | One-way tunnels | For networks with a diode enforcing unidirectional traffic. |
| Cathedral | Relay, discovery, keying | A discovery, relay and key distribution point for your networks. |
| Liturgy | Auto-discovery & mesh | Automatic peer discovery via a cathedral with possibility to use DNS resolving for hosts. |
Tunnel mode
This mode supports the classic site-to-site and client-to-site setups. Sanctum is configured with the IP address of its peer (if known) and its local address.
This mode is also used when configuring Sanctum as a cathedral client. In this case a cathedral endpoint is configured instead of an IP address for your peer — discovery and the establishment of a P2P E2EE tunnel happen automatically.
Pilgrim-shrine mode
Use this mode when you have a diode in your network path that enforces unidirectional traffic. The pilgrim is the sender while the shrine is the receiver. Because of how privilege separation works in Sanctum, no return traffic is possible — a great choice for implementing software diodes.
Liturgy mode
Liturgy mode allows Sanctum to use cathedrals to auto-discover multiple peers belonging to the same flock. When peers are discovered, a tunnel is automatically established; if a peer goes offline, the tunnel goes offline automatically too.
Because it uses cathedrals, both peers may live behind NAT or firewalls. Cathedrals help establish a direct P2P connection when possible, otherwise traffic is relayed over the cathedral.
Note: cathedrals can never read any traffic — they are only ever able to relay it.
Cathedral mode
In this mode Sanctum only acts as a cathedral — a peer discovery, traffic relay and key distribution point. Cathedrals can federate with each other to create resilient infrastructure that becomes hard to take down.
Read the full cathedral setup guide →
Roaming
Roaming just works in Sanctum — tunnels update their peer endpoints automatically as devices move between networks.