docs(readme): gateway shipped in 26.21-alpha, roadmap + key decision

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -11,6 +11,15 @@ This project uses calendar versioning: `YY.N-stage` (e.g. `26.0-alpha` = 2026, r
 
 ### Added
 
+- **Furtka Gateway: apps reachable from the internet** (behind NAT/CGNAT,
+  no port forwarding). Settings → *Furtka Gateway*: enter the gateway URL
+  and registration token, the box registers and keeps a WireGuard tunnel to
+  a [furtka-gateway](https://forgejo.sourcegate.online/robert/furtka-gateway)
+  server (Traefik + wg-easy + control plane). Apps → ⋯ → *Expose to
+  Internet* publishes an app under its own hostname with Let's Encrypt;
+  *Stop exposing* takes it down again. Only apps whose manifest declares
+  `internet.viable: true` can be exposed. Client in `furtka/gateway.py` +
+  `furtka/wireguard.py`, CLI `furtka gateway …`.
 - **New logo: Mark M** (a lowercase *f* cut out of an arched gate), winner of
   the furtka.org vote (29 of 42 votes). It is now in the website header,
   favicon and share card, the installer header and tab icon, the on-box UI

README.md

@@ -56,7 +56,7 @@ Furtka aims to be:
 | Identity provider | Authentik | Bundled SSO from day one — every app template auto-wires to it at install |
 | Managed gateway DNS | NS delegation to `ns1.furtka.org` | User delegates once at registrar; we handle wildcard cert + subdomain creation |
 | Local HTTPS | Local CA | One-click CA install → green padlock on every service, no browser warnings |
-| Gateway | Flexible | Own reverse proxy OR managed through our infrastructure |
+| Gateway | Traefik + wg-easy ([furtka-gateway](https://forgejo.sourcegate.online/robert/furtka-gateway)) | Decided 2026-10-23. Self-hosted on any VPS with a public IPv4 via `deploy.sh`, or managed through our infrastructure later. Boxes dial out over WireGuard, so no port forwarding at home. |
 | UI approach | UI-first | Design the simplest possible UI, then build everything to match |
 
 ## Landscape (Existing Projects)
@@ -122,10 +122,13 @@ None of these nail the "your dad can set this up" experience. The installer wiza
 - [x] **Phase 2 Furtka self-update** — `/settings` → Check → Update now. Downloads signed tarball (SHA256), stages, atomic symlink flip, reloads Caddy, daemon-reload, restarts services, health-checks the new api with auto-rollback on failure. CLI: `furtka update [--check]` + `furtka rollback`. Validated end-to-end on VM 2026-04-16 (`26.0-alpha` → `26.3-alpha` → rollback → reboot).
 - [x] **Local HTTPS Phase 1** — Caddy `tls internal` on `:443` is fully opt-in via the `/settings` toggle (26.15-alpha); fresh installs stay HTTP-only so a half-trusted cert chain can't lock the user out. Per-box root CA generated on first enable, `rootCA.crt` downloadable from `/settings`, per-OS install guide at `/https-install/`. The "force HTTPS" sub-toggle still only appears once the current browser already trusts the cert.
 - [x] **Post-build smoke VM on Proxmox** — `.forgejo/workflows/build-iso.yml` hands the freshly built ISO to `scripts/smoke-vm.sh`, which boots it in a throwaway VM on `pollux` (192.168.178.165) and curls the webinstaller on `:5000`. VMID range 9000–9099, last 5 kept. Green end-to-end since 26.4-alpha.
+- [x] **Furtka Gateway (Access Gate)** — boxes behind NAT/CGNAT register with a [furtka-gateway](https://forgejo.sourcegate.online/robert/furtka-gateway) server (Traefik + wg-easy + control plane) over a WireGuard tunnel; Settings → *Furtka Gateway* connects, Apps → ⋯ → *Expose to Internet* publishes an app under its own hostname with Let's Encrypt. Only apps with `internet.viable: true` in the manifest can be exposed. Shipped in `26.21-alpha`; first gateway running at `gw.furtka.org` (Hetzner, 2026-10-23).
+- [x] **`26.21-alpha`** — security fixes (app-name validation, `.env` injection, fail-closed `users.json`, API hardening), installer fixes, Mark M logo, furtka.org/download, on-box UI polish. See [CHANGELOG](CHANGELOG.md).
+- [ ] Gateway dogfooding on real hardware — two old laptops as boxes, one per brother, both behind CGNAT
 - [ ] Installer wizard screens S3–S7 — per-device purpose, network, domain, SSL, diagnostic. S5/S6 blocked on managed-gateway DNS infra not yet built.
 - [ ] Local HTTPS Phase 2 — dedicated local CA (not Caddy's `tls internal`), streamlined one-click install across Win/Mac/Linux/Android, and HTTPS on the live-installer wizard (`https://proksi.local:5000`).
 - [ ] Caddy + Authentik wired into first-boot bootstrap
-- [ ] Managed gateway infrastructure — `ns1/ns2.furtka.org` + DNS-01 wildcard automation
+- [ ] Managed gateway DNS — `ns1/ns2.furtka.org` + DNS-01 wildcard automation (the gateway itself works today with your own domain and per-app or wildcard A records)
 - [ ] First containerized service (Nextcloud?) with auto-SSO + auto-subdomain
 - [ ] Competitor hands-on testing on Proxmox — validate findings from docs/competitors.md
 - [ ] UI mockups / drafts (Robert)