# Private HoneyMesh Exchange: organization setup blueprint

**Status:** controlled preview design, 2026-10-30. This document is a planning and pilot guide. The self-host installer and a generally available private Exchange release have not yet passed production validation.

## What your organization runs

Run one HoneyMesh Exchange Node.js service on an organization controlled Linux VM, behind an HTTPS reverse proxy. Give it durable private storage and a dedicated service account. HoneyMesh agents remain on the Linux systems they protect. An agent can point to your Exchange using its `exchange.base_url` setting; that address must be HTTPS and trusted by the host. Do not disable certificate validation.

The Exchange is the coordination point for cluster discovery, approved relationships, short-lived signal delivery, and audit. It is not a universal authority to ban traffic. Each receiving node retains its local mode, trusted cluster list, allowlist, and enforcement setting.

## Set the organizational boundary first

1. Choose a DNS name such as `exchange.security.example.com` and decide which networks can reach it. Keep the Node port and database inaccessible from the public Internet.
2. Name the service owner, backup owner, and two administrators. Use an identity and MFA process controlled by your organization.
3. List each network and cluster that will enroll. Give each cluster its own identity. A node secret, certificate, or private key must never be reused across networks.
4. Decide whether this Exchange is strictly internal or may bridge to another Exchange. Start internal; treat every bridge as a separate trust decision.
5. Choose retention, backup, restore, and deletion policy before importing real indicators.

## Deploy the preview Node service

The current Exchange codebase is a Next.js Node service with signed machine APIs and a SQLite single-writer pilot store. A production deployment needs a durable database decision, encrypted backups, a restore drill, and update/rollback procedure. The Node service should listen on loopback behind an HTTPS reverse proxy that overwrites forwarded IP and scheme headers. Set `EXCHANGE_PUBLIC_ORIGIN` to your own HTTPS origin; leave discovery disabled until first administrator provisioning and access control have been reviewed. Store runtime secrets in a mode-0600 server environment file, never in the site source or downloadable archive.

Do not use the public marketing site as the Exchange database or admin console. The organization controls the Exchange service and its data.

## Enroll and trust networks

1. Provision the first Exchange administrator locally and enable MFA. Do not ship shared default credentials.
2. Install a valid HoneyMesh Pro release on each participating host. Community local protection does not enable Exchange participation.
3. Configure each agent for the private Exchange URL and enroll it with its own signed identity. Confirm the reported cluster ID before approving it.
4. Make each cluster visible only to the intended organization members. Approve publishing and receiving independently. Directory visibility and a discovery request alone do not create trust.
5. Begin with `exchange.auto_enforce` disabled and a restricted `exchange.trusted_clusters` list. Review signed feed delivery and audit events before authorizing short-lived enforcement.

The Exchange protocol supports signed node requests and explicit relationships. Direct mesh connection is a separate action and still requires a peer address and temporary invite. A relationship may be revoked; previously applied temporary bans must expire or be released locally.

## Pilot and recovery checks

- Send one controlled, authorized test signal and verify its publisher, recipient, reason category, and expiry.
- Verify that a cluster without an approved relationship receives nothing.
- Revoke a relationship and verify future delivery stops.
- Disable receiving and test the local Exchange kill switch.
- Restore a backup into an isolated test instance; confirm administrators, policies, audit, and signal expiry behave as expected.
- Confirm that loss of Exchange connectivity does not disable local HoneyMesh protection.

## Release status

The existing Exchange service has a live hosted pilot at `honeymesh.io`. That pilot is not the general organization self-host package. Its local SQLite database, in-process application Guard, and optional agent bridge have documented limits. The private package needs repeatable installation, first-admin bootstrap, recovery testing, security review, and an exact versioned release before a turnkey download is offered. Contact `Admin@Network-Decode.com` for a guided private pilot.