nirpa/granthi-sync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: sign in from any computer, no private network needed

Browse Source 
granthi-link is now public at https://granthi-link.shre.ai (cloudflared,
origin still tailnet-only), so the client defaults there instead of a tailnet
IP. Internal machines pass --server or GRANTHI_LINK_SERVER.

Two rollout traps recorded in the README: a third-level hostname
(link.granthi.shre.ai) fails TLS because Cloudflare Universal SSL covers
shre.ai and *.shre.ai only; and exposure REQUIRES trust_forwarded_for with
the tunnel as the sole trusted proxy, or every request looks like the tunnel
and one abuser spends everyone's rate budget.

178 tests.
This commit is contained in:
claude
2026-08-23 12:33:19 -04:00
parent dbd6bb6cd0
commit 49ab2a7408
3 changed files with 44 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+20 -9
View File
@@ -29,8 +29,10 @@ git CLI only — same portability heritage as the estate's `gitea_sync.py` mesh.
## Quickstart (invited user)
You need a shre-id account — an operator creates it; there is no open signup
(see "Invite-only story"). You also need to be on the tailnet: the
provisioning service is not publicly exposed yet.
(see "Invite-only story"). You do **not** need to be on any private network:
the provisioning service answers at `https://granthi-link.shre.ai`, which is
the client's default server. Internal machines can still pass
`--server http://100.111.127.127:3042` to reach it over the tailnet.
```sh
git clone https://granthi.shre.ai/nirpa/granthi-sync.git
@@ -166,11 +168,18 @@ So:
* **Our own machines** may join the tailnet — that is an operator action with
an operator's judgement behind it.
* **Customer devices never do.** Their transport is public HTTPS to
granthi-link and the forge through cloudflared. That is the same exposure
step already in the promotion window below, and it is what makes a genuinely
new computer able to onboard itself at all — today `link` only works from
inside the tailnet, which means "you can't set up a new computer without an
operator first" is the honest status.
granthi-link and the forge through cloudflared. **Done 2026-08-23:**
`https://granthi-link.shre.ai` fronts `:3042` on the `pulse-granthi-edge`
tunnel, so a new computer signs itself in with one command and never
touches the private network.
Two things that bit during that rollout, worth not rediscovering:
`link.granthi.shre.ai` fails TLS — Cloudflare's Universal SSL covers
`shre.ai` and `*.shre.ai`, **not** a third-level `*.granthi.shre.ai`, so
the hostname has to be second-level. And exposure REQUIRES
`trust_forwarded_for: true` with `trusted_proxies: ["100.107.37.98/32"]`
in the same change: behind the tunnel every request otherwise looks like
the tunnel itself, and one abuser would spend everybody's rate budget.
## Components
@@ -537,8 +546,10 @@ Shape this should take, so the next session does not re-litigate it:
## Promotion window (beta → prod)
1. **Expose :3042** behind cloudflared (granthi.shre.ai vhost or
link.granthi.shre.ai) — today it is tailnet-only by design.
1. ~~**Expose :3042** behind cloudflared~~ **DONE 2026-08-23** —
`https://granthi-link.shre.ai` (second-level, see above), origin stays
tailnet-only, `trust_forwarded_for` on with the tunnel as the only
trusted proxy.
2. **Swap forge base URLs** in `/opt/granthi-link/config.json`:
`gitea_base` → prod forge, `public_gitea_base` →
`https://granthi.shre.ai`; the client default server URL moves to the