nirpa/granthi-sync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: sign in from any computer, no private network needed

Browse Source 
granthi-link is now public at https://granthi-link.shre.ai (cloudflared,
origin still tailnet-only), so the client defaults there instead of a tailnet
IP. Internal machines pass --server or GRANTHI_LINK_SERVER.

Two rollout traps recorded in the README: a third-level hostname
(link.granthi.shre.ai) fails TLS because Cloudflare Universal SSL covers
shre.ai and *.shre.ai only; and exposure REQUIRES trust_forwarded_for with
the tunnel as the sole trusted proxy, or every request looks like the tunnel
and one abuser spends everyone's rate budget.

178 tests.
This commit is contained in:
claude
2026-08-23 12:33:19 -04:00
parent dbd6bb6cd0
commit 49ab2a7408
3 changed files with 44 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/granthi_sync_client.py
+6 -1
View File
@@ -87,7 +87,12 @@ ZITADEL_BASE = "https://id.shre.ai"
DEVICE_CLIENT_ID = "386909715541590022"
# ^ Zitadel native app "granthi-sync-device" (appId 386909715541524486) in
# project granthi-forge (386906525790109702); device-code + refresh grants.
DEFAULT_SERVER = "http://100.111.127.127:3042"
# Public by default: a genuinely new computer cannot be expected to join a
# private network before it can sign in. The tailnet address still works and
# is what internal machines should pass to --server.
DEFAULT_SERVER = os.environ.get("GRANTHI_LINK_SERVER",
"https://granthi-link.shre.ai")
TAILNET_SERVER = "http://100.111.127.127:3042"
DEVICE_SCOPE = "openid profile email"
FORGE_PAGE_LIMIT = 50