Public address for the invited Hub

The browser origin is https://daedro.hub.rokenshi.com. The application remains an invited pilot with Google sign-in and mandatory authenticator verification. Public passkey registration is disabled. A public address is not a claim of production readiness or general customer onboarding.

Routing and secrets

Cloudflare hosts a DNS-only A record for daedro.hub, pointing to the VM's reserved regional IPv4 address, 136.119.231.10 (daedro-hub-ip, us-central1). Caddy terminates HTTPS and automatically renews its certificate. The multi-level hostname uses the origin certificate rather than Cloudflare Universal SSL.

Only TCP 80 and 443 are permitted by the daedro-hub-web ingress rule and VM tag. Port 80 redirects to HTTPS and supports certificate validation. The Hub listens on 127.0.0.1:8797; Caddy preserves the configured hostname. OpenBao on private port 8200, the Secret Unix socket, worker sockets and media tunnels are not public. SSH remains restricted to the existing IAP rule.

The Caddy configuration does not persist request access/error logs containing callback URLs, cookies or request bodies. The application still enforces exact origin, CSRF headers, finite sessions, invited Google identities and action-bound TOTP. Provider secrets never enter DNS or the OAuth client configuration.

Reproduce and roll back

The tracked files are deploy/gcp/public/Caddyfile and deploy/gcp/public/origin.conf. Install the former as /etc/caddy/Caddyfile and the latter in /etc/systemd/system/daedro-connected-hub.service.d/origin.conf. Validate Caddy before reload and run systemctl daemon-reload after a unit change. Google's Web client must allow the exact HTTPS /auth/google/callback URI. Its private client secret stays in /etc/daedro-hub/google.json, owned by the Hub service identity with mode 0600, outside Git.

Before this cutover, the previous binary and account metadata were preserved on the VM as daedro-shared.before-public and accounts.before-public.json. The account schema change is additive; do not overwrite current accounts during ordinary code rollback. To close public access, remove the dedicated web tag or disable its ingress rule. To return to the previous localhost origin, remove the origin override, restore the previous binary if needed, restart the Hub and restore the localhost OAuth redirect explicitly. Browser sessions expire on restart. Localhost passkeys do not authenticate on the public domain.

Budget and availability

No additional VM, managed load balancer, Cloud NAT or paid Cloudflare certificate is needed. The existing in-use IPv4 address was reserved rather than replaced. Google lists the same $0.005/hour for in-use static and ephemeral external IPv4 addresses (about $3.65 per 730-hour month). A reserved address remains chargeable when the VM is stopped; release it when decommissioning the pilot, after removing its DNS record. Network egress and the existing VM/disk remain usage charges. Google network pricing.

The existing automatic VM stop remains November 12, 2026 at 10:43:36 Asia/Saigon. This domain change does not extend that window. Audio/video still depend on the operator's private CPU workers and their IAP tunnels; a public frontend does not remove that dependency. Factor recovery, backups, availability and public customer policies remain release work.