The hub is reached privately over the tailnet first; a public ingress is a deployment target, never an application change

majordomus://adr/adr-0204proposed mesh-runtimechatgpt-project

it references

put_in_force adr-0126
put_in_force majordomus (deployment)
put_in_force the-mesh-is-operated-from-any-device (intent)
put_in_force I3195
put_in_force I3196
put_in_force lundra-is-the-always-on-hub (knowledge)
put_in_force the-hub-is-reached-from-any-device

referenced by

Nothing in the layer names it. Backlinks are derived, so an empty list is an answer rather than an omission.

204. The hub is reached privately over the tailnet first; a public ingress is a deployment target, never an application change

Context

2026-09-11: the owner rejected free PaaS hosting, named Lundra (behind NAT) and a Cloudflare account, and asked to use a Tailscale name now and majordomus.dev later. The control surface can run commands on a workstation.

Decision

Lundra is the persistent hub. Phase 1 serves it tailnet-only over HTTPS on its ts.net name (no Funnel); phase 2 adds a Cloudflare Tunnel with access in front over the same origin, which listens on loopback. Both may coexist; switching is deployment configuration. Network privacy is not authorisation: edge identity plus application authorisation (ADR 0126, web-sign-in).

Alternatives rejected

Free PaaS tiers
Router port-forwarding
Tailscale Funnel by default
An anonymous public Cockpit

Consequences

the-hub-is-reached-from-any-device (I3195..I3197).

Sources

Promoted on 2026-10-18 from the owner's ChatGPT project (workspace chatgpt-majordomus, issue I3100). The owner's acceptance is at chatgpt-majordomus:c118#6; accepting this record is still the owner's act.

chatgpt-majordomus:c118#5
chatgpt-majordomus:c118#9

Where this comes from

canonical file: .ai/repo/adrs/0204-the-hub-is-reached-privately-over-the-tailnet-first-a-public-ing.md
identity: adr-0204
also served as: MCP resource majordomus://adr/adr-0204 · majordomus entity show adr/adr-0204 · GET /api/v1/entity?uri=majordomus://adr/adr-0204
in the Cockpit: /cockpit/objects/adr/adr-0204

This page is generated from the file above by scripts/generate-site-data; editing the page changes nothing, editing the file changes every surface. The relations above are edges of docs/generated/graph.json, which the executable writes from the same index.