Fork of EdgeLinkd · Apache-2.0 Flow Copilot · experimental

Node-RED,
reimplemented
in Rust

n2link runs your Node-RED flows on a native Rust runtime, with the Node-RED editor built in. Keep your flows.json, drop the Node.js runtime, and add production controls for credentials, inbound traffic and outbound connections.

Get started View on GitHub

bash — n2link

# clone and build (Rust 1.88+, npm for the editor build)
git clone --recursive https://github.com/n2link/n2link.git
cd n2link && cargo build --release
# run: editor at http://127.0.0.1:1888
./target/release/n2linkd

AlphaNo Node.js at runtimeflows.json compatible

The n2link editor with a flow drafted by Flow Copilot: an MQTT subscription adds a timestamp, then writes CSV and caches the latest value in Redis. The Copilot panel and debug messages are on the right. — The real editor, served by `n2linkd`. The lower flow was drafted by Flow Copilot from one sentence.

Native Rust runtime
Node-RED editor built in
flows.json compatible
MQTT · HTTP · WebSocket · TCP/UDP
Redis · PostgreSQL
Linux · Windows · ARM

Flow Copilot · experimental

Describe it.
Review the draft. Deploy.

Flow Copilot lives in the editor sidebar. You describe a flow in plain language; it drafts nodes and wires from the node catalog of this runtime, and nothing runs until you review the draft and press Deploy.

Screen recording, n2link 0.4.0-rc.1 · 5:47Trimmed at the start, otherwise unedited

What you see in the recording

1
Connect a provider
An ai-provider config node holds the model settings: OpenAI, Anthropic, xAI or Snowflake Cortex.
2
Describe the flow
Pick the target flow and model in the Copilot panel and write what you want, e.g. read CPU usage with an exec node and publish it to a local MQTT topic.
3
Get a grounded draft
The draft uses only nodes installed in this runtime, with their named ports and payload types, and is checked against node metadata.
4
Apply, review, deploy
Apply to flow imports the draft into the editor. You inspect it, then Deploy like any other change.

EndpointPOST /assistant/draft

LimitsOwn rate and concurrency budget in [api_protection.copilot]

OutboundProvider calls go through the egress policy

Experimental. Drafts can add and connect nodes; they don't edit or delete existing ones yet. Live provider runs are not part of the automated test suite, which uses a deterministic local provider. Details in known issues.

Screens

The editor you already know

n2link serves the Node-RED editor itself, so palettes, debug messages and deploys work the way they do in Node-RED. The n2link additions sit in the same sidebar and settings.

Flow Copilot drafted flow with MQTT, CSV and Redis nodes — **A drafted flow, running**Subscribe, timestamp, then CSV and a Redis cache, from one prompt.

Debug sidebar with messages and the storage palette — **Debug and palette**Messages as they arrive; storage nodes including PostgreSQL and Redis.

Outbound network policy settings in the editor — **Outbound network policy**Read, validate, save and roll back the `[egress]` table from User Settings.

Why n2link

Built for gateways, controllers and small machines

The same editor and flows as Node-RED, on a single Rust binary, with the controls you need before a flow engine goes near production equipment.

Web UI

Editor built in

Design, deploy and debug in the browser. Admin login supports viewer, deployer and administrator roles or OIDC. Run --headless in production.

flows.json

Drop-in flows

Bring your existing flows.json and credential files. Deploys are revision-checked and one previous copy is kept for rollback.

QuickJS

Native nodes, JS where it counts

Only the function node runs JavaScript, in an embedded QuickJS interpreter. Every other node is native Rust.

XChaCha20-Poly1305

Encrypted credentials

An explicit credentials migrate encrypts the sidecar, with a backup. Rotate, recover and export are built into the CLI.

Hardened

Inbound and outbound controls

Per-endpoint request budgets, an optional bearer token for http in, and an outbound allowlist you roll out from observe to enforce.

Experimental · opt-in

WASM plugin nodes

Third-party nodes run in a Wasmi sandbox with no file, network, clock or credential access. Installs are staged, self-tested and atomic.

Quick start

From clone to flows

Build once from source, then it's one binary. npm is only needed at build time, to build the bundled Node-RED editor.

Build and run

# prerequisites: Rust 1.88+, git, Node.js with npm (build time only)
git clone --recursive https://github.com/n2link/n2link.git
cd n2link

# release build, including the Node-RED editor
cargo build --release

# run: opens the editor at http://127.0.0.1:1888
./target/release/n2linkd

# production: your own flow file, no web UI
./target/release/n2linkd run ./flows.json --headless

Editor127.0.0.1:1888

Data and config~/.n2linkd

All commandsn2linkd --help

Supported targets

x86_64-unknown-linux-gnuLinux
x86-64
x86_64-pc-windows-msvcWindows (also -gnu)
x86-64
aarch64-unknown-linux-gnu64-bit ARM, e.g. Raspberry Pi 4/5
ARM64
armv7-unknown-linux-gnueabihf32-bit ARM (also gnueabi)
ARMv7

Windows builds need patch.exe on PATH (it ships with Git) and Visual Studio for MSVC.

What you get

The editor and runtime API on one port; change it with --bind
Flows, credentials and settings under ~/.n2linkd
A commented n2linkd.toml written on first start
MQTT, HTTP, WebSocket, TCP/UDP, Redis and PostgreSQL nodes in the default build; Modbus with --features nodes_modbus

Architecture

Rust core, JS where it counts

No Node.js runtime. QuickJS runs Function nodes, Wasmi runs plugin nodes, and everything else is native Rust.

Runtime	Rust on Tokio
Function node	Embedded QuickJS
Editor	Node-RED editor, served by `n2linkd`
Plugins	Wasmi sandbox, opt-in
History	SQLite deploy, node and Copilot history, opt-in

n2linkd

CORERust flow engineTokio · flows.json

QuickJSfunction nodes

WASMWasmi sandbox

Web UIeditor + admin API

MQTT

HTTP · WS

TCP · UDP

Modbus

dashed: optional build feature

Configuration

Config highlights

n2linkd.toml

Bind address and port for the editor and runtime API. --bind overrides it on the command line.

Configuration guide →

n2linkd.toml

[ui-host]
host = "0.0.0.0"
port = 1888

# or on the command line
# n2linkd run --bind 0.0.0.0:1888

CLI

Existing plaintext flows_cred.json files keep working. Encryption is an explicit step: preview it, then migrate with a new, empty backup directory.

Credential lifecycle →

shell

n2linkd credentials status
n2linkd credentials migrate --dry-run
n2linkd credentials migrate --backup-dir /offline/n2link-credential-backup

# later
n2linkd credentials rotate --backup-key /offline/old-flows-cred.key

n2linkd.toml

Each endpoint class (editor, auth, WebSocket, health, Copilot, http in…) has its own body, rate, concurrency and deadline budget.

Inbound protection runbook →

n2linkd.toml

[api_protection]
trusted_proxies = []
# every `http in` listener requires this bearer token
webhook_bearer_env = "N2LINK_WEBHOOK_TOKEN"

[api_protection.webhook]
mode = "enforce"   # or "observe" while migrating
requests_per_minute = 600
max_concurrency = 16

n2linkd.toml

Start in observe to inventory outbound connections, then enforce an exact protocol and port allowlist. Cloud metadata endpoints stay denied.

Egress policy runbook →

n2linkd.toml

[egress]
mode = "observe"  # then "enforce"
allow_environment_proxy = false

[[egress.allow]]
protocols = ["mqtt"]
host = "127.0.0.1"
ports = [1883]

n2linkd.toml

Flow Copilot is in the default build. Structural checks against node metadata are on by default; the endpoint has its own request budget.

Copilot known issues →

n2linkd.toml

[copilot]
strict_metadata = true

[api_protection.copilot]
mode = "enforce"
requests_per_minute = 30
max_concurrency = 2

build + n2linkd.toml

Opt-in twice: build with the feature, then enable it. Plugins are staged and self-tested before activation, with one-call rollback.

WASM plugin operations →

shell + n2linkd.toml

cargo build --release --features nodes_wasm
n2linkd plugin stage my_plugin.wasm
n2linkd plugin activate --sha256 <hex> acme/my-plugin

[runtime.wasm]
enabled = true

Use cases

Where n2link fits

Anywhere you'd run Node-RED but would rather ship one native binary with explicit security controls.

IoT edge gateways

Collect sensor data over MQTT or TCP and forward it upstream, with outbound connections limited to an allowlist.

Industrial automation

Run control and data flows on industrial PCs with encrypted credentials and per-endpoint request limits.

Home automation

Run your existing flows on a Raspberry Pi, with the editor in the browser and no Node.js install on the device.

Cloud-to-edge migration

Prototype in Node-RED, then deploy the same flows.json to n2link at the edge.

Remote management

Edit flows remotely through the web editor, behind admin roles or OIDC, with deploy and Copilot history.

Development to production

Use the editor while building, then run the same binary with --headless in production.

Support n2link

Keep the steam going

n2link is built, debugged and maintained in personal time, and much of that work runs on paid AI tokens: Flow Copilot is tested against live models, and the code is reviewed and debugged with AI help. If n2link saves you time, a donation helps keep it moving.

A coffeeKeeps an evening of debugging going.
A token refillPays for live provider runs and AI-assisted reviews.
Maintenance timeFixes, releases, docs and answering issues.

Not able to donate? A star on GitHub, a bug report or a pull request helps too.

Buy the maintainer a coffee

Scan with your phone, or open the link. Any amount helps.

airtm.me/edwin30cg33xl

Donate on Airtm

Node-RED,reimplementedin Rust

Describe it.Review the draft. Deploy.

Connect a provider

Describe the flow

Get a grounded draft

Apply, review, deploy

The editor you already know

Built for gateways, controllers and small machines

Editor built in

Drop-in flows

Native nodes, JS where it counts

Encrypted credentials

Inbound and outbound controls

WASM plugin nodes

From clone to flows

Rust core, JS where it counts

Config highlights

Where n2link fits

IoT edge gateways

Industrial automation

Home automation

Cloud-to-edge migration

Remote management

Development to production

Keep the steam going

Buy the maintainer a coffee

Node-RED,
reimplemented
in Rust

Describe it.
Review the draft. Deploy.