@codions/portta 0.0.0-develop.155.sha-e6e3870 → 0.0.0-develop.159.sha-0da77d5

package/dist/host.js

@@ -72223,7 +72223,7 @@ function createDaemonTaskflowHost(context) {
       port: hostListen(env2).port,
       workflowBuiltinsDir: taskflowAssets(env2).workflowBuiltinsDir,
       version: env2.PORTTA_VERSION || "0.0.0-local",
-      buildDate: true ? "2026-09-16T16:54:30Z" : (/* @__PURE__ */ new Date()).toISOString(),
+      buildDate: true ? "2026-09-17T17:01:02Z" : (/* @__PURE__ */ new Date()).toISOString(),
       environmentStore: createEnvironmentStore(paths.database),
       hostEnvironmentProvider: new HostEnvironmentProvider(),
       devContainerProvider: new DevContainerProvider(),

package/dist/runtime/.env.example

@@ -161,23 +161,28 @@ PORTTA_WEB_PORT=8081
 #              entrypoint. Requires PORTTA_AUTH_MODE=required; the panel
 #              authenticates requests itself.
 #   vpn        routed by Traefik at PORTTA_WEB_HOST.<domain>, which is
-#              meaningful only on the remote-private profile. Requires a
-#              credential, and is refused on remote-public.
+#              meaningful only on the remote-private profile. Refused on
+#              remote-public. Accepts PORTTA_AUTH_MODE=disabled, and
+#              `portta web up --expose vpn` makes the panel read-only unless
+#              --writable is given.
+#   domain     routed by Traefik on one hostname of the gateway's own domain,
+#              PORTTA_PANEL_ADVERTISED_HOST. Requires PORTTA_AUTH_MODE=required.
 #
-#   portta config set panel.access public|tailscale|local
+#   portta config set panel.access local|tailscale|vpn|public|domain
 #
 # switches between them on an installed host without reinstalling.
 PORTTA_WEB_EXPOSE=local
 PORTTA_WEB_HOST=portta-web
 
 # The address the panel is advertised at in `public` mode, where the published
-# port belongs to Traefik and 0.0.0.0 is not something anybody types. The
-# installer fills this with the detected public IP or hostname; it is cosmetic
-# and changes no binding.
+# port belongs to Traefik and 0.0.0.0 is not something anybody types, and the
+# hostname Traefik routes in `domain` mode. In `public` mode it changes no
+# binding.
 PORTTA_PANEL_ADVERTISED_HOST=
 
-# Refuse every mutating endpoint. Useful when an agent is driving the panel,
-# and the default whenever the panel is routed beyond loopback.
+# Refuse every mutating endpoint. Useful when an agent is driving the panel.
+# `portta web up --expose vpn` sets it unless --writable is given; no other
+# access mode turns it on by itself.
 PORTTA_WEB_READ_ONLY=false
 
 # The panel's own front door, which is now the panel's own business.
@@ -275,7 +280,7 @@ PORTTA_AUTH_USER=
 # PORTTA_AUTH_USER=1000:1000
 
 # ----------------------------------------------------------------------------
-# Applying settings from the panel: optional, off by default
+# Applying settings from the panel: enabled in this template
 # ----------------------------------------------------------------------------
 # Traefik reads its static configuration from the environment its container was
 # created with, so a setting the panel saves takes effect only once the gateway
@@ -291,7 +296,8 @@ PORTTA_AUTH_USER=
 # Be clear about what this grants: anyone who can write through the panel can
 # run `portta up` on this host. It is refused in read-only mode, the applier
 # takes no input, and the panel never gains `exec`. Leave it false on a host
-# where the panel is reachable by anyone you would not hand a shell.
+# where the panel is reachable by anyone you would not hand a shell. The panel
+# cannot change this value; only an edit of this file on the host does.
 #
 # On a repository checkout -- PORTTA_WEB_BUILD or PORTTA_WEB_DEV -- the apply
 # rebuilds the local images first. The build runs on the host daemon, not inside
@@ -302,18 +308,25 @@ PORTTA_AUTH_USER=
 PORTTA_APPLY=true
 
 # Prepare the project runner the panel may start to drive Compose for one
-# project (up, stop, restart, build, down). Off by default, and deliberately
-# absent from the Settings catalogue — turning it on is an edit on the host.
+# project (up, stop, restart, build, down). Enabled in this template, and
+# deliberately absent from the Settings catalogue — changing it is an edit on
+# the host. The runner holds the Docker socket and a view of the host
+# filesystem; set it to false where the panel is reachable by anyone you would
+# not hand a shell.
 # See docs/development/adr/0030-the-panel-and-a-project-lifecycle.md.
 PORTTA_RUNNER=true
 
 # ----------------------------------------------------------------------------
-# Task Flow and the host daemon: off by default
+# The host daemon, and the Task Flow module (off by default)
 # ----------------------------------------------------------------------------
-# Task Flow's work needs the host (git worktrees, tmux, agent CLIs), so it runs
-# in `portta host serve`, a daemon on the host, and the panel reaches it through
-# an authorised proxy. Turning this on gives the panel a name for the host and
-# the daemon's token (state/host/token), read-only; nothing else.
+# Work that needs the host -- issues through `gh` and Linear, and Task Flow's
+# git worktrees, tmux and agent CLIs -- runs in `portta host serve`, a daemon on
+# the host. Whenever the panel is on, it gets a name for the host and the
+# daemon's token (state/host/token), read-only, and reaches the daemon through
+# an authorised proxy.
+#
+# PORTTA_TASKFLOW only switches the Task Flow module on in the CLI, the daemon
+# and the panel; the panel's route to the daemon does not depend on it.
 #
 # The daemon binds loopback by default, which a panel container reaches on
 # Docker Desktop. On Linux, bind it to the Docker bridge gateway instead, for

package/dist/runtime/VERSION

@@ -1 +1 @@
-0.0.0-develop.155.sha-e6e3870
+0.0.0-develop.159.sha-0da77d5

package/dist/runtime/docker/compose/features/panel-public.yaml

@@ -1,10 +1,8 @@
 # ============================================================================
 # Portta: the panel on a public address, behind Portta ForwardAuth
 # ============================================================================
-# Applied when PORTTA_WEB_EXPOSE=public. This is the mode the installer offers
-# first, because it is the shortest path to a usable development VPS.
-#
-# Two properties make it safe enough to be the default, and both are load
+# Applied when PORTTA_WEB_EXPOSE=public, the shortest path to a panel on a
+# development VPS. Two properties make it safe enough, and both are load
 # bearing:
 #
 #   1. The panel gets its OWN Traefik entrypoint (`panel`, :8090 inside the
@@ -15,16 +13,16 @@
 #
 #   2. The panel signs people in itself. There is no middleware on this
 #      router: `PORTTA_AUTH_MODE=required` is what stands in front of it, the
-#      panel's own process refuses to start in `disabled` mode on anything but
-#      loopback, and `portta web up --expose public` refuses before that.
-#      See docs/development/adr/0035-authentication-lives-in-the-panel.md.
+#      panel's own process refuses to start with `public` access in `disabled`
+#      mode, and `portta web up --expose public` refuses before that.
+#      See docs/development/adr/0051-authentication-is-optional-inside-a-trusted-network.md.
 #
 # The panel container itself publishes no host port here (web-bind.yaml is not
 # applied), so the only way in is through this entrypoint.
 #
 # HTTP, not HTTPS, when the address is a bare IP: there is no certificate a
 # public CA will issue for one. The password is checked by the panel but the
-# connection is not encrypted, and the installer says so in as many words.
+# connection is not encrypted.
 # `--expose domain` is the mode that gets a real certificate.
 # ============================================================================
 

package/dist/runtime/docker/compose/features/web.yaml

@@ -178,9 +178,12 @@ services:
       #
       # `required` makes it sign people in: accounts, roles, sessions and
       # tokens, all in its database. `disabled` makes every request the local
-      # operator, and the process refuses to start that way on anything but
-      # loopback. The secret signs sessions and is shared with the ForwardAuth
-      # service, which is the only other thing here that signs anything.
+      # operator. It is accepted with panel access `local`, `tailscale` and
+      # `vpn`, and the process refuses to start that way with `public` or
+      # `domain`. `local` bound to anything but loopback also needs
+      # PORTTA_AUTH_ALLOW_LAN=true. The secret signs sessions and is shared with
+      # the ForwardAuth service, which is the only other thing here that signs
+      # anything.
       #
       # PORTTA_PANEL_URL is where a browser reaches it, and three things come
       # from it: whether the session cookie may be `Secure`, which origins a
@@ -188,6 +191,7 @@ services:
       # loopback on the published port.
       PORTTA_AUTH_MODE: ${PORTTA_AUTH_MODE:-disabled}
       PORTTA_AUTH_SECRET: ${PORTTA_AUTH_SECRET:-}
+      PORTTA_AUTH_ALLOW_LAN: ${PORTTA_AUTH_ALLOW_LAN:-false}
       PORTTA_PANEL_URL: ${PORTTA_PANEL_URL:-}
       PORTTA_PANEL_TRUSTED_ORIGINS: ${PORTTA_PANEL_TRUSTED_ORIGINS:-}
       PORTTA_RUNTIME_DYNAMIC_DIR: /app/state/traefik-dynamic
@@ -222,7 +226,7 @@ services:
       #   state/auth       credentials the panel manages, never served directly
       #   state/ssh        SSH credentials the panel manages, never served directly
       #   traefik/dynamic  read-write, and the ONE place the panel configures
-      #                    Traefik. It may write four generated filenames there
+      #                    Traefik. It may write three generated filenames there
       #                    and refuses every other path in its own process.
       #                    See docs/development/adr/0011-bounded-traefik-write-surface.md.
       - ./.env:/app/state/.env

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codions/portta",
-  "version": "0.0.0-develop.155.sha-e6e3870",
+  "version": "0.0.0-develop.159.sha-0da77d5",
   "description": "Machine-first CLI for a shared Docker development gateway",
   "license": "MIT",
   "type": "module",