# Public address for the invited Hub

The browser origin is **https://daedro.hub.rokenshi.com**. The application remains
an invited pilot with Google sign-in and mandatory authenticator verification.
Public passkey registration is disabled. A public address is not a claim of
production readiness or general customer onboarding.

## Routing and secrets

Cloudflare hosts a DNS-only A record for `daedro.hub`, pointing to the VM's
reserved regional IPv4 address, `136.119.231.10` (`daedro-hub-ip`, us-central1).
Caddy terminates HTTPS and automatically renews its certificate. The multi-level
hostname uses the origin certificate rather than Cloudflare Universal SSL.

Only TCP 80 and 443 are permitted by the `daedro-hub-web` ingress rule and VM tag.
Port 80 redirects to HTTPS and supports certificate validation. The Hub listens
on `127.0.0.1:8797`; Caddy preserves the configured hostname. OpenBao on private
port 8200, the Secret Unix socket, worker sockets and media tunnels are not public.
SSH remains restricted to the existing IAP rule.

The Caddy configuration does not persist request access/error logs containing
callback URLs, cookies or request bodies. The application still enforces exact
origin, CSRF headers, finite sessions, invited Google identities and action-bound
TOTP. Provider secrets never enter DNS or the OAuth client configuration.

## Reproduce and roll back

The tracked files are `deploy/gcp/public/Caddyfile` and
`deploy/gcp/public/origin.conf`. Install the former as `/etc/caddy/Caddyfile` and
the latter in `/etc/systemd/system/daedro-connected-hub.service.d/origin.conf`.
Validate Caddy before reload and run `systemctl daemon-reload` after a unit change.
Google's Web client must allow the exact HTTPS `/auth/google/callback` URI.
Its private client secret stays in `/etc/daedro-hub/google.json`, owned by the Hub
service identity with mode 0600, outside Git.

Before this cutover, the previous binary and account metadata were preserved on
the VM as `daedro-shared.before-public` and `accounts.before-public.json`.
The account schema change is additive; do not overwrite current accounts during
ordinary code rollback. To close public access, remove the dedicated web tag or
disable its ingress rule. To return to the previous localhost origin, remove the
origin override, restore the previous binary if needed, restart the Hub and
restore the localhost OAuth redirect explicitly. Browser sessions expire on
restart. Localhost passkeys do not authenticate on the public domain.

## Budget and availability

No additional VM, managed load balancer, Cloud NAT or paid Cloudflare certificate
is needed. The existing in-use IPv4 address was reserved rather than replaced.
Google lists the same $0.005/hour for in-use static and ephemeral external IPv4
addresses (about $3.65 per 730-hour month). A reserved address remains chargeable
when the VM is stopped; release it when decommissioning the pilot, after removing
its DNS record. Network egress and the existing VM/disk remain usage charges.
[Google network pricing](https://cloud.google.com/vpc/network-pricing).

The existing automatic VM stop remains November 12, 2026 at 10:43:36 Asia/Saigon.
This domain change does not extend that window. Audio/video still depend on the
operator's private CPU workers and their IAP tunnels; a public frontend does not
remove that dependency. Factor recovery, backups, availability and public
customer policies remain release work.