# Set up the public account pilot

The public process serves the marketplace, handbook, Google sign-in for invited members and a test subscription console. It listens on a loopback socket behind your TLS proxy. Host Docker management on a separate private listener with a separate operating-system account. A public account session has no authority to start a container.

## Start with the public catalogue

Build `bin/daedro-mcp-hub` and install it on the selected host. Start it with the exact origin registered for the service.

```sh
bin/daedro-mcp-hub public --origin https://daedro.hub.rokenshi.com --port 8793
```

A request forwarded by the proxy must retain this Host. The application ignores forwarded identity and host headers. The public catalogue and published schemas work before account credentials are configured. The sign-in page explains how to obtain an invitation. Google OAuth, the payment provider and a public DNS record must be configured independently.

The sample service runs under the dedicated `daedro-public` account. Restrict incoming traffic to the HTTPS proxy and your administrator's SSH policy. For a DNS-only record, let the edge obtain a public certificate for the full hostname. Confirm certificate coverage for this exact nested hostname if placing a CDN in front of it. Compare the VPS options, then provision DNS and TLS when ready. [Service unit](../deploy/daedro-public.service) · [Caddy configuration](../deploy/Caddyfile) · [Hosting](hosting.md)

## Connect Google

In a Google Cloud project owned by the seller, configure a Web application OAuth client and register the **exact** redirect URI `https://daedro.hub.rokenshi.com/auth/google/callback`. Set the consent and authorized-domain records for the real operator. The application requests the `openid` scope and identifies a member by Google's stable subject. The operator must verify each subject against the correct person through an authenticated channel. [Google OpenID Connect](https://developers.google.com/identity/openid-connect/openid-connect)

Create a mode-0600 settings file owned by the account that runs the service (here, `daedro-public`) outside the checkout and pass it with `public --config /etc/daedro-public/accounts.json`. Use genuine local values in place of this synthetic schema example. Generate a different opaque 32-hex ID per member with `openssl rand -hex 16`.

```json
{
  "google_client_id": "YOUR_WEB_CLIENT_ID",
  "google_client_secret": "YOUR_WEB_CLIENT_SECRET",
  "google_subjects": {
    "VERIFIED_GOOGLE_SUBJECT": {
      "id": "11112222333344445555666677778888",
      "name": "Pilot team",
      "admin": false
    }
  }
}
```

Go to `/account` and select **Continue with Google**. Successful callbacks return to the account page. Sessions expire within an hour or when the service restarts. To revoke an invitation, edit the private settings and restart the public process. Before allowing public sign-in, enforce request-rate limits for `/auth/google/start` at the trusted ingress. The process caps in-flight anonymous sign-ins globally, so unthrottled requests can temporarily fill that capacity. Account administrators can open `/admin` to see invited members and verified test-invoice counts. Assign this role explicitly in the private settings. Workspace bearer keys remain a separate credential.

## Exercise a test subscription

Add an optional `stripe_sandbox` object to the settings with `test_key`, `test_webhook_secret`, `monthly_price_id`, `monthly_usd_cents`, `ledger_dir` and `ledger_key_file`. Use an approved **test-mode** monthly USD price and enable the stablecoin payment method in the provider sandbox. Some functionality depends on the processor approving the account. Set `ledger_dir` to a private directory under the public service's protected state directory. Generate a separate key once in a new private file, store it outside the ledger and back it up securely.

```sh
(umask 077; set -C; openssl rand -hex 32 > billing-state.key)
```

Register `https://daedro.hub.rokenshi.com/billing/stripe/webhook` for test-mode `invoice.paid` snapshot events with Stripe API version `2026-10-28.endive`. The authenticated account page displays the configured sandbox price. Returning to the browser after checkout never confirms an invoice. The public service records provider-verified test receipts only. These receipts grant no paid production capacity. [Billing and legal launch decisions](billing.md)