$ grab publish ./my-site --name awesome --erasure 4+2
GRAB_NET
Decentralized web hosting protocol. Publish websites to the permanent web with stable addresses that never change — on a network that gets lighter, not heavier, as more nodes join.
// Native chunk dedup · Reed-Solomon erasure · libp2p · Single Rust binary
// The Core Promise
Hosting That Gets Cheaper As The Network Grows
Most decentralized systems get more expensive per node the more sites they pin — every host stores a full copy of everything. GrabNet is built the opposite way. Two mechanisms make storage burden trend toward zero per node as peers join, without ever throwing archival data away.
Native Chunk Dedup
Every chunk is keyed by blake3(data) in a single per-node store at ~/.grab/chunks. Identical bytes across files, revisions, and unrelated sites are stored exactly once. Re-publishing only writes new chunks; old revisions stay archived for free.
Erasure-Coded Sharding
Opt in with --erasure 4+2: each chunk becomes 6 Reed-Solomon shards. Each peer holds 1–2 of them. Network-wide cost is ~1.5× site size instead of N×, any 4 of 6 reconstruct the chunk, and 33% loss tolerance is preserved.
Archival Is Free
Old revisions and unreferenced chunks are kept — dedup means historical data costs nothing extra at the chunk level. Garbage collection is opt-in, never automatic. The permanent web stays permanent.
// Why GrabNet
Built for Websites
Stable Addresses
Your site ID is derived from your key + name. It never changes, even after thousands of updates. No more IPNS slowness.
Delta Sync
Merkle tree diffing means only changed chunks transfer. Update a 10MB site by sending just 50KB.
Native HTTP Gateway
Serve sites directly over HTTP from any node. No external gateway required. Works with any reverse proxy or VPN.
Single Binary
No Node.js, Python, or runtime dependencies. Just one Rust binary. Download and run.
Cryptographic Ownership
Ed25519 signatures prove you own your content. No one can impersonate your site or push fake updates.
Auto-Replication
Peers hosting your site automatically sync when you push updates. Your content propagates to the network.
Watch Mode
Develop with --watch flag for automatic republishing on file changes. Perfect for local development.
Deploy Hooks
Run custom commands before and after publishing. Integrate with build tools and notifications.
Native HTTPS / TLS
Built-in rustls termination. Drop in a Let's Encrypt cert with --tls-cert / --tls-key; pass --https-port to get an automatic HTTP→HTTPS 308 redirect. No reverse proxy required.
DNS & Host Aliases
Map any hostname to a site with --alias example.org=<site>, or run with --dns-aliases and let the gateway resolve _grab.<host> TXT records on demand. One gateway can serve unlimited sites by virtual host, just like Apache or nginx.
ENS Resolution
Use *.eth names as site identifiers. The gateway exposes /ens/<name> which redirects to the site id stored in the grab-site ENS text record. Works with the public ENS gateway out of the box.
CDN-Ready Caching
Strong BLAKE3 ETags, Cache-Control: immutable on content-addressed assets, Vary: Accept-Encoding, and on-the-wire gzip. Stick Nginx, Varnish, or any edge worker in front and it Just Works.
Browser Extension
An MV3 extension (extension/grabnet-resolver) adds a grab address-bar keyword and rewrites in-page grab:// links through your local or hosted gateway. Reach the GrabNet web from any standard browser without changing OS settings.
// Quick Start
Up and Running in 2 Minutes
# Clone and build git clone https://github.com/mwillis775/grab.git cd grab && cargo build --release # Publish a website ./target/release/grab publish ./my-website --name my-site 📦 Publishing ./my-website... ✓ Bundled 23 files (1.2 MB) ✓ Compressed to 340 KB (72% smaller) ✓ 45 chunks (45 new) 🌐 Site ID: grab://AtnArdZARzYJ7sTKYdrn4HHYsofuSe9gonDNsrqwFFa1 📝 Name: my-site 🔄 Revision: 1 # Start gateway to serve your site ./target/release/grab gateway --port 8080 🌐 GrabNet Gateway running on http://127.0.0.1:8080 # Your site is now live at: # http://127.0.0.1:8080/sites/my-site/
// Compare
GrabNet vs The Rest
| Feature | Traditional | IPFS | GrabNet |
|---|---|---|---|
| Address stability | ✓ Fixed | ✗ Changes on update | ✓ Stable forever |
| Name resolution | ✓ Fast DNS | ✗ IPNS is slow | ✓ <100ms via DHT |
| Update efficiency | ✓ Incremental | ✗ Full re-upload | ✓ Delta sync |
| Storage efficiency | ✗ N copies of every byte | ✓ Per-CID dedup only | ✓ Global chunk dedup + erasure |
| Per-node burden as network grows | ✗ Grows linearly | ✗ Full pin per host | ✓ Shrinks (sharded across peers) |
| Censorship resistance | ✗ Single server | ✓ Distributed | ✓ Distributed |
| Native HTTP serving | ✓ Yes | ✗ Needs gateway | ✓ Built-in |
| Setup complexity | ✗ Complex | ✗ Complex | ✓ Single binary |
| Ongoing cost | ✗ Server fees | ✓ Free (if pinned) | ✓ Free |
// Architecture
Under the Hood
┌─────────────────────────────────────────────────────────────────┐
│ CLI │
│ grab publish | update | gateway │
├─────────────────────────────────────────────────────────────────┤
│ Grab SDK │
│ High-level API for all operations │
├─────────────────────────────────────────────────────────────────┤
│ HTTP Gateway │
│ axum server for HTTP/HTTPS access │
├───────────────────────────┬─────────────────────────────────────┤
│ User Content │ Publisher │
│ Uploads & Moderation │ Bundle, Chunk, Sign │
├───────────────────────────┴─────────────────────────────────────┤
│ P2P Network │
│ libp2p: Kademlia DHT + Gossipsub + Noise │
├─────────────────────────────────────────────────────────────────┤
│ Storage │
│ sled: Chunks, Bundles, Keys, Metadata │
├─────────────────────────────────────────────────────────────────┤
│ Crypto │
│ BLAKE3 hashing + Ed25519 signing │
└─────────────────────────────────────────────────────────────────┘
// Network Telemetry
Live Stats [ loading… ]
Public health signals from the live gateway. Operational counters stay behind the admin console.
// Adversaries · Threat Model
What We Defend Against
Mass fake-peer flooding
mitigation: Kademlia k=20 bucket diversity + libp2p peer scoring + IP-bucket caps in gossipsub mesh.
Isolating a node from honest peers
mitigation: Bootstrap rotation, random peer-id seeding, and outbound connection diversity. No single seed can hold the gateway hostage.
Pushing fake updates for someone's site
mitigation: Every revision is signed with the publisher's Ed25519 key. Site IDs are derived from blake3(pubkey || name). Forgery requires breaking either primitive.
Forcing content to disappear
mitigation: Reed-Solomon 4+2 shards spread across 8+ peers globally. Survives loss of 33% of replicas + arbitrary single-jurisdiction takedowns.
Sniffing or rewriting traffic in flight
mitigation: All transport runs noise_xx with rotating session keys. Application data is always content-addressed by blake3; tampering = hash mismatch = rejected.
Resource-exhaustion against gateways
mitigation: Per-IP rate limits, gossipsub mesh pruning, configurable chunk-size caps, and shard-mode reconstruction so a missing replica can't starve the request.
// Join the Network
Start Hosting
GrabNet is open source and free to use. Clone the repo, build the binary, and start publishing your websites to the permanent web.