Connect S3 in the private Hub

Open https://daedro.hub.rokenshi.com. The Hub runs on the Google VM behind a TLS reverse proxy. Browser access no longer needs a tunnel from your computer. This is an invited pilot; the public address does not enable open registration. OpenBao and worker interfaces remain private.

The earlier http://localhost:8797 address was an IAP development entry point. Its passkeys are bound to localhost and do not automatically transfer to the public domain. Existing account records and secrets have not been deleted.

Create an account

Open Account from the marketplace. When the operator has configured Google sign-in and invited your Google account, choose Continue with Google. Complete Google's account selection, then scan the enrollment QR with Google Authenticator and enter the current six-digit code. Returning members verify a fresh code after Google sign-in. Google sign-in alone does not unlock your connections.

The public sign-in screen offers Google. Earlier localhost passkey accounts retain their records and secrets; accessing them requires their original origin through the operator. A Google identity and an earlier passkey account remain separate. Matching display names or email addresses never transfer secret ownership. Account linking requires an explicit, authenticated flow.

The account page keeps your Personal and Work profiles separate. Switching profiles clears visible results and loads that profile's connections. The account security page describes the active sign-in method and authenticator requirements.

Browse your storage

1. Select Personal or Work and add an S3 connection.
2. Enter a label and your read-only S3 access key for the provider configured on this installation. A temporary provider key may also require a session token.
3. Review the provider, profile, permitted actions and grant limits. Confirm with Google Authenticator. Each successful action consumes the authenticator time-step. If you just signed in, wait for the next code.
4. Open the connection. Select a bucket, filter objects by prefix and choose an object to inspect its metadata. A key scoped to a single bucket may lack permission to list buckets. Enter its bucket name directly in that case.

The pilot grant permits up to 100 reads over at most 24 hours. Replacing a key, renewing access, revoking a grant and deleting a connection each require fresh confirmation. Revocation blocks new Hub reads. Revoke the provider key at the provider if it must stop working outside the Hub as well.

What the pilot stores

The Hub stores account handles, display names and passkey public keys. Daedro Secret separately encrypts provider credentials and authenticator information in private OpenBao. A successful browse uses a one-use, request-bound worker ticket. Results appear in your selected profile. Each S3 call starts a new read-only MCP container. The container can reach only the operator-selected S3 destination via its relay. Grant changes and reads are audited without credential values or provider response bodies.

This single-node pilot has bounded in-memory sessions and depends on the private tunnel for browser access. The operating system and Docker administrators remain in its trust boundary. Before public launch the service needs tested backup and factor recovery, independent audit retention, automated unseal and durable availability. See the publication specification.

Server acceptance

On November 5, 2026, the private Google VM ran the Hub, Secret API and S3 worker as separate Linux identities. An HTTP acceptance client used two independently generated ES256 passkeys, registered two TOTP factors, signed back in and tested the personal/work profiles for both accounts. Foreign connection reads, object metadata requests, secret deletions, cross-profile approval and OTP replay were denied. A temporary connection belonging to one QA account successfully listed real buckets and objects and fetched object metadata. Revocation denied the next read and an independently confirmed deletion removed the temporary connection. The test used software authenticators and the actual browser API routes. The customer completes their own platform authenticator prompt during first use.