GXTD-196 front-door launcher
Homelab public front door
b9343779.eero.online is the HTTPS public edge canary plus the accepted Authentik/OIDC launcher surface. It exposes only the routes below; everything else remains tailnet, app-native, API-token, or network-controlled.
public HTTPS + accepted SSO routes active
Accepted browser routes
Static dashboard SSO
Non-mutating dashboard canary protected by Authentik forward-auth.
GXTD-189 accepted
SearXNG SSO
Metasearch UI protected through Caddy forward-auth. Alias redirects to the functional
/searxng/ base path.
GXTD-190 accepted
Open WebUI OIDC
Native Open WebUI OIDC through Authentik on the private tailnet route; local login remains break-glass.
GXTD-194 accepted
Boundaries
- No n8n, pgAdmin, ComfyUI, Hermes Dashboard, Home Assistant, database, cache, router, or hardware-control route is added here.
- Hindsight, Docling, Firecrawl API, Postgres, Redis, and llama routers remain API/network controlled rather than browser-SSO surfaces.
- Public
/healthremains unauthenticated for edge monitoring.