daniel/furtka
1
1
Fork 0
Code Issues 2 Pull requests 2 Projects 1 Releases 19 Packages Wiki Activity Actions

docs: Remote-Access-Gateway-Design (v1, user-hosted) #16

Open
daniel wants to merge 1 commit from docs/remote-access-design into main
pull from: docs/remote-access-design
merge into: daniel:main
Conversation 0 Commits 1 Files changed 1 +362
daniel commented 2026-08-24 15:14:03 +02:00
Owner
Copy link

Design-Doc als Grundlage fuers Meeting heute — bitte nicht ohne Review mergen, das Doc IST der Meeting-Input.

Kern: furtka-gateway (neues Repo, docker-compose auf User-VPS): Caddy (On-Demand-TLS, LE pro Subdomain, kein Wildcard/DNS-01) + gatewayd (stdlib-Python: Pairing, Route-Sync, WG-Peers, Caddyfile-Push). Box = reiner WG-Client (outbound-only, CGNAT-fest). https://jellyfin.example.de -> VPS-Caddy -> Tunnel -> Box-Hostport. Manifest bekommt optionales expose-Objekt; Per-App-Toggle, Default AUS.

Abweichungen von Roberts April-Proposal (begruendet in Sec. 2): Caddy statt Traefik; 2 Komponenten statt 3 (Pairing-Webseite entfaellt — Code kommt aus der VPS-Konsole); DNS vor Pairing (echtes TLS statt TOFU).

Die 4 offenen Fragen fuer heute (Sec. 12):

  1. Reserved-Name gw. vs furtka-gw. + Admin-UI jemals exponierbar?
  2. Gateway-Basic-Auth in v1 oder Cut? (Empfehlung: drin)
  3. Install-UX: curl | bash vs 3-Schritt?
  4. Deutsches Wording ("Fernzugriff"?) + Wizard S5/S6 jetzt oder settings-first? (Empfehlung: settings-first)

Phasenplan: P1 = Tracer Bullet (1-2 Tage, Hand-Compose auf sauberem Test-VPS, Demo am Handy ueber LTE) validiert On-Demand-LE, WebSockets und Tunnel-MTU, bevor eine Zeile Pairing-Code existiert.

🤖 Generated with Claude Code

Design-Doc als Grundlage fuers Meeting heute — **bitte nicht ohne Review mergen, das Doc IST der Meeting-Input.** **Kern:** `furtka-gateway` (neues Repo, docker-compose auf User-VPS): Caddy (On-Demand-TLS, LE pro Subdomain, kein Wildcard/DNS-01) + `gatewayd` (stdlib-Python: Pairing, Route-Sync, WG-Peers, Caddyfile-Push). Box = reiner WG-Client (outbound-only, CGNAT-fest). `https://jellyfin.example.de` -> VPS-Caddy -> Tunnel -> Box-Hostport. Manifest bekommt optionales `expose`-Objekt; Per-App-Toggle, Default AUS. **Abweichungen von Roberts April-Proposal (begruendet in Sec. 2):** Caddy statt Traefik; 2 Komponenten statt 3 (Pairing-Webseite entfaellt — Code kommt aus der VPS-Konsole); DNS vor Pairing (echtes TLS statt TOFU). **Die 4 offenen Fragen fuer heute (Sec. 12):** 1. Reserved-Name `gw.` vs `furtka-gw.` + Admin-UI jemals exponierbar? 2. Gateway-Basic-Auth in v1 oder Cut? (Empfehlung: drin) 3. Install-UX: `curl | bash` vs 3-Schritt? 4. Deutsches Wording ("Fernzugriff"?) + Wizard S5/S6 jetzt oder settings-first? (Empfehlung: settings-first) Phasenplan: P1 = Tracer Bullet (1-2 Tage, Hand-Compose auf sauberem Test-VPS, Demo am Handy ueber LTE) validiert On-Demand-LE, WebSockets und Tunnel-MTU, bevor eine Zeile Pairing-Code existiert. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
daniel added 1 commit 2026-08-24 15:14:03 +02:00
docs: remote-access gateway design (user-hosted VPS stack, v1)
All checks were successful
CI / lint (pull_request) Successful in 26s
Details
CI / test (pull_request) Successful in 1m17s
Details
CI / validate-json (pull_request) Successful in 21s
Details
CI / markdown-links (pull_request) Successful in 14s
Details
a9596e3e41 
Design doc for the remote-access feature: user-hosted furtka-gateway
compose stack (Caddy + stdlib-Python gatewayd) on the user's VPS,
WireGuard tunnel with the box as outbound-only client, pairing protocol
with console-printed one-time codes and HMAC-bound key exchange,
versioned box->gateway route-sync API, optional manifest 'expose'
object, v1 auth story (app-native logins + basic-auth guardrail,
Authentik as later 'forward' enum value), threat model (box-side
nftables on the WG interface is v1-blocking), multi-tenant-capable
constraints for a later managed phase, and a 6-phase implementation
plan starting with a manual tracer bullet.

Supersedes wizard-flow.md S5/S6 remote paths for v1. Basis for the
Daniel/Robert review meeting 2026-08-24; four open questions are
listed at the end of the doc.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BFapVxVPvJJXwngkdbndxn
All checks were successful
CI / lint (pull_request) Successful in 26s
Required
Details
CI / test (pull_request) Successful in 1m17s
Required
Details
CI / validate-json (pull_request) Successful in 21s
Required
Details
CI / markdown-links (pull_request) Successful in 14s
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin docs/remote-access-design:docs/remote-access-design
git checkout docs/remote-access-design
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: daniel/furtka#16
No description provided.
Delete branch "docs/remote-access-design"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?