c0cd367a0e
The operator was right to challenge POST /enrol. The three values a script needs before the tunnel exists — hub key, hub address, assigned tunnel IP — are all known to the console when the host is created, so they travel in the copied command instead of being fetched. The one thing that forced an endpoint was the hub needing the host's public key before the tunnel is up. So the console generates the pair and hands it over, and the host swaps in a freshly generated key through the tunnel afterwards. The key that passed through a clipboard lives for minutes. Net effect: the network boundary is unchanged. No new way in from outside. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| 2026-07-25-host-onboarding-design.md | ||
| 2026-07-27-mailboxes-design.md | ||
| 2026-07-27-operator-identity-design.md | ||
| 2026-07-30-betriebsmodus-und-betriebsbereitschaft-design.md | ||
| 2026-07-30-host-uebernahme-statt-installation-design.md | ||
| 2026-07-30-stripe-price-adoption-design.md | ||