Use sprites connectors and flyctl to add sprites to your 6pn

This is more of an amuse-bouche than an entire vegetable fresh out of the ground, but a few folks have asked about it, so here’s something that’s worked for me.

fly tokens create wireguard gives you a token scoped to WireGuard peer management: it can add and remove peers in your org, and read the rest of the org, but not touch your apps. Fly’s GraphQL API has an addWireGuardPeer mutation. So you can create a sprites connector with:

• base URL https://api.fly.io
• auth header prefix FlyV1
• token: everything after FlyV1 in the output of fly tokens create wireguard
• an access policy (an empty one admits no sprites)

Then I spun up a small Go service, borrowing heavily from flyctl itself, that runs userspace WireGuard on the sprite side of things. It also handles calling out to the connector to grab a peer for your sprite.

I haven’t run any serious workloads on it yet (and for that, I’d probably reach for tailscale, and use a subnet router), but I’m sharing in case the approach is useful to anyone else!