MINI-ROOK / BUILD LOG 031
The Secure Gateway
A private authenticated gateway reaches a Samsung phone
TECHNICAL CHECKPOINT
What this build actually records.
- Stack and method
- Loopback reverse proxy · Basic authentication · tailnet-only HTTPS · endpoint/Origin/JSON checks
- Recorded progress
- Syntax, 401/200/403/415 gateway scenarios and authenticated tailnet HTTPS checks pass; creator confirms authenticated Samsung Nest access.
- Still open at this checkpoint
- Gateway needs its separately started process; Basic auth is interim, not device identity or granular authorization. Access acceptance is not a comprehensive mobile-layout or security certification.
Software development on an existing workstation. This entry does not establish a new robot, custom hardware build or autonomous publishing capability.
TEST STATUS / SEPARATE FROM THE ORIGINAL RECORD
What later checks established.
Syntax, 401/200/403/415 gateway scenarios and authenticated tailnet HTTPS checks pass; creator confirms authenticated Samsung Nest access.
Still open: Gateway needs its separately started process; Basic auth is interim, not device identity or granular authorization. Access acceptance is not a comprehensive mobile-layout or security certification.
01 / BUILD LOG 031
The original development record
Mini-Rook now has a separate loopback-only authenticated reverse proxy (secure_gateway.py) on 127.0.0.1:18766. It requires HTTP Basic authentication with a generated high-entropy password stored locally in the Windows user profile (~/.mini-rook/gateway-password.txt). It allows only known app/API endpoints, rejects untrusted Host headers, and enforces same-origin plus JSON content-type for POST. Credential values are never included in build logs or terminal output.
Tailscale Serve now exposes the gateway at a private tailnet HTTPS hostname on port 8443 (tailnet only). The pre-existing publicly reachable Funnel on HTTPS 443 still routes to 127.0.0.1:8780 and was not altered. Mini-Rook itself remains bound to 127.0.0.1:18765; no Windows Firewall or direct LAN listener was opened.
Verified on Fury: Python syntax PASS, unauthenticated gateway 401 PASS, authenticated local /health 200 PASS, forged Host 403 PASS, foreign POST Origin 403 PASS, non-JSON POST 415 PASS, authenticated HTTPS over Tailnet 200 PASS. Tailscale status lists the separate tailnet-only port and the unchanged legacy Funnel.
Limitations: the creator confirmed successful authenticated access to The Nest from a Samsung phone through the private Tailscale HTTPS gateway. The gateway process currently runs as a separate locally started Python process, not an auto-start service; it must be running for remote access. Basic authentication is an interim shared credential, not device-bound identity or granular authorization. The existing local /api/security/readiness endpoint describes direct backend exposure and is not a gateway status endpoint.
Status: READY TO PUBLISH — SAMSUNG MOBILE ACCESS ACCEPTANCE PASS; NOT YET PRODUCTION HARDENED. Chapter VIII — The Nest.
02 / BUILD LOG 031
Public edition note
The private tailnet hostname is omitted from this public edition. The original source retains the operational address; the recorded architecture, test results and limitations are preserved.
KEEP FOLLOWING THE BIRD