We've been quietly building something on top of go53 — and it's almost ready to share. Meet Starling.
What is Starling?
Where go53 answers "what is the address of this name?", Starling answers the next question: "which people and machines exist, what may they do, and how do they reach each other?"
In short: Starling joins Linux hosts into an internal DNS and access-control fabric, then manages SSH access and local authorization through signed, encrypted, replicated policies. It's the first step in turning the go53 family into a single, deployable product — Identity · Access · Control.
What it does
- Join a Linux host with a single-use token — it gets a replicated identity.
- Manage users, groups, sudo rules and policy assignments centrally.
- Apply signed, per-host policy on each agent (local users, groups, sudoers).
- SSH access through a built-in certificate authority — no more
authorized_keyssprawl. - Discover hosts and services over authoritative DNS (
A/AAAA/SRV/PTR). - Replicate all state across nodes over go53's signed event-sync.
Secure by design
Starling keeps two cryptographic layers apart: server-to-server replication is **Ed25519-signed*powers go53), while every agent-to-server message rides a modern X25519 → HKDF-SHA256 →ChaCha20-Poly1305 envelope. Built on go53, it inherits its API-first, replicated foundation.
Open source, soon
Starling is under active development as a productification effort — APIs and shapes may still shift — but the direction is set, and it's on its way to open source under the EUPL-1.2, just like the rest of the go53 family.
Watch this space.