Remote Access (Gate L)

Gladious web binds to 0.0.0.0:3773 (WEB_HOST / next dev|start -H 0.0.0.0). The public URL for browsers and OAuth is NEXTAUTH_URL — currently HTTPS via Nginx Proxy Manager:

• Open: https://gladious.kozehub.point2this.com
• Upstream: NPM Gladious.kozehub.point2this.com → http://10.0.0.8:3773
• Loopback (localhost / 127.0.0.1) redirects to that public origin

Discord OAuth always uses NEXTAUTH_URL for redirect_uri — do not register localhost in the Portal.

For who can sign in (owners vs one-server staff), see PANEL_ACCESS.md.

HTTPS (Nginx Proxy Manager) — required for Discord + Spotify

1. In NPM → Proxy Hosts, confirm Gladious.kozehub.point2this.com forwards to 10.0.0.8:3773 (HTTP).
2. SSL tab: request a Let’s Encrypt certificate for that hostname, enable Force SSL / HSTS (same pattern as Panel.kozehub.point2this.com).
3. Root .env:

   NEXTAUTH_URL=https://gladious.kozehub.point2this.com
   AUTH_TRUST_HOST=true
   WEB_HOST=0.0.0.0
   WEB_PORT=3773
   

4. Restart web after changing .env.
5. Discord Developer Portal → OAuth2 → Redirects — add exactly (no trailing slash):
   • https://gladious.kozehub.point2this.com/api/auth/callback/discord
6. Spotify Developer Dashboard → Redirect URIs — add exactly:
   • https://gladious.kozehub.point2this.com/api/spotify/callback
7. The /login page shows the exact Discord redirect_uri NextAuth will send.

Without a valid TLS cert on the Gladious proxy host, https://… will fail in the browser even if HTTP on port 80 works.

Same Wi‑Fi (LAN only, no hostname)

Direct LAN access still works for debugging (http://10.0.0.8:3773), but OAuth redirects always go to NEXTAUTH_URL. Prefer the HTTPS hostname for login.

If the site loads on this PC but not on a phone via LAN IP:

• Allow inbound TCP 3773 in Windows Firewall: scripts\allow-web-firewall.cmd (or pnpm firewall:web).
• If NordVPN / NordLynx is connected, enable “Allow local network access”.

Option A — Tailscale (private access off-LAN)

1. Install Tailscale on the Gladious host and your client devices: https://tailscale.com/download
2. Sign in to the same Tailnet on both.
3. On the host, note the Tailscale IP (100.x.y.z) via tailscale ip -4.
4. Only use Tailscale as the public origin if you are not using the HTTPS hostname — set NEXTAUTH_URL=http://100.x.y.z:3773 and add that Discord redirect.
5. Prefer keeping NEXTAUTH_URL=https://gladious.kozehub.point2this.com when NPM + DNS already expose the panel.

Option B — Cloudflare Tunnel

1. Create a tunnel in Cloudflare Zero Trust → Networks → Tunnels.
2. Install cloudflared on the Gladious host.
3. Route a hostname to http://127.0.0.1:3773 (or keep NPM in front).
4. Set NEXTAUTH_URL=https://<that-hostname> and AUTH_TRUST_HOST=true.
5. Add matching Discord / Spotify redirect URIs.

Hardening checklist

• Strong NEXTAUTH_SECRET
• OAuth client secret only in .env
• Owner list reviewed (OWNER_DISCORD_IDS + /admin/owners)
• Bot token never pasted into chat or committed
• Firewall denies public 5432 / 4001 unless intentional
• TLS enabled on the Gladious NPM proxy host
• PM2 or Windows service keeps processes up: pnpm pm2:start

Local-only reminder

To lock the dashboard to this PC only, bind with WEB_HOST=127.0.0.1 and change the web scripts’ -H flag accordingly, then use console / RDP / physical access only. (You would still need a matching public NEXTAUTH_URL if OAuth must work.)