Set up the public account pilot

The public process serves the marketplace, handbook, Google sign-in for invited members and a test subscription console. It listens on a loopback socket behind your TLS proxy. Host Docker management on a separate private listener with a separate operating-system account. A public account session has no authority to start a container.

Start with the public catalogue

Build bin/daedro-mcp-hub and install it on the selected host. Start it with the exact origin registered for the service.

bin/daedro-mcp-hub public --origin https://daedro.hub.rokenshi.com --port 8793

A request forwarded by the proxy must retain this Host. The application ignores forwarded identity and host headers. The public catalogue and published schemas work before account credentials are configured. The sign-in page explains how to obtain an invitation. Google OAuth, the payment provider and a public DNS record must be configured independently.

The sample service runs under the dedicated daedro-public account. Restrict incoming traffic to the HTTPS proxy and your administrator's SSH policy. For a DNS-only record, let the edge obtain a public certificate for the full hostname. Confirm certificate coverage for this exact nested hostname if placing a CDN in front of it. Compare the VPS options, then provision DNS and TLS when ready. Service unit · Caddy configuration · Hosting

Connect Google

In a Google Cloud project owned by the seller, configure a Web application OAuth client and register the exact redirect URI https://daedro.hub.rokenshi.com/auth/google/callback. Set the consent and authorized-domain records for the real operator. The application requests the openid scope and identifies a member by Google's stable subject. The operator must verify each subject against the correct person through an authenticated channel. Google OpenID Connect

Create a mode-0600 settings file owned by the account that runs the service (here, daedro-public) outside the checkout and pass it with public --config /etc/daedro-public/accounts.json. Use genuine local values in place of this synthetic schema example. Generate a different opaque 32-hex ID per member with openssl rand -hex 16.

{
  "google_client_id": "YOUR_WEB_CLIENT_ID",
  "google_client_secret": "YOUR_WEB_CLIENT_SECRET",
  "google_subjects": {
    "VERIFIED_GOOGLE_SUBJECT": {
      "id": "11112222333344445555666677778888",
      "name": "Pilot team",
      "admin": false
    }
  }
}

Go to /account and select Continue with Google. Successful callbacks return to the account page. Sessions expire within an hour or when the service restarts. To revoke an invitation, edit the private settings and restart the public process. Before allowing public sign-in, enforce request-rate limits for /auth/google/start at the trusted ingress. The process caps in-flight anonymous sign-ins globally, so unthrottled requests can temporarily fill that capacity. Account administrators can open /admin to see invited members and verified test-invoice counts. Assign this role explicitly in the private settings. Workspace bearer keys remain a separate credential.

Exercise a test subscription

Add an optional stripe_sandbox object to the settings with test_key, test_webhook_secret, monthly_price_id, monthly_usd_cents, ledger_dir and ledger_key_file. Use an approved test-mode monthly USD price and enable the stablecoin payment method in the provider sandbox. Some functionality depends on the processor approving the account. Set ledger_dir to a private directory under the public service's protected state directory. Generate a separate key once in a new private file, store it outside the ledger and back it up securely.

(umask 077; set -C; openssl rand -hex 32 > billing-state.key)

Register https://daedro.hub.rokenshi.com/billing/stripe/webhook for test-mode invoice.paid snapshot events with Stripe API version 2026-10-28.endive. The authenticated account page displays the configured sandbox price. Returning to the browser after checkout never confirms an invoice. The public service records provider-verified test receipts only. These receipts grant no paid production capacity. Billing and legal launch decisions