Design doc for the remote-access feature: user-hosted furtka-gateway
compose stack (Caddy + stdlib-Python gatewayd) on the user's VPS,
WireGuard tunnel with the box as outbound-only client, pairing protocol
with console-printed one-time codes and HMAC-bound key exchange,
versioned box->gateway route-sync API, optional manifest 'expose'
object, v1 auth story (app-native logins + basic-auth guardrail,
Authentik as later 'forward' enum value), threat model (box-side
nftables on the WG interface is v1-blocking), multi-tenant-capable
constraints for a later managed phase, and a 6-phase implementation
plan starting with a manual tracer bullet.
Supersedes wizard-flow.md S5/S6 remote paths for v1. Basis for the
Daniel/Robert review meeting 2026-08-24; four open questions are
listed at the end of the doc.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BFapVxVPvJJXwngkdbndxn
