pastilhasandClaude Opus 5
1e6b01cd21
The owner's design, agreed in conversation and written down before it evaporates — this session started by recovering a design that had been lost with its chat. The premise is what makes it small: the tailnet becomes the perimeter and devices are admitted by hand, so there is no authentication work inside it. Sidecars keep trusting their caller; the boundary moves from loopback to the tailnet. Six points: ecosystem is the source of truth and PM2 starts everything (peers, never children — that was the tree-kill bug); one fixed port per sidecar; the platform reads the table rather than being told at runtime; .env toggles features; NPM maps /api/<feature> straight at the sidecar; the platform keeps auth and the frontend's own state and comes off the data path. What it buys is deletion: connect.ts's dial-and-register loop, every *:server port announcement, and most of sidecar-registry.ts. Also records what was considered and dropped — token distribution to every sidecar, a public auth sidecar with JWKS, and the idea that Origin headers are a security boundary — so none of it gets re-argued from scratch. Nothing is built. Music is the first migration, end to end, with officer's proxy kept as a fallback. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>