C3 — proven live: a .fab export → import makes a family-only app public
Scratch guest 9202, controller 0.331.0 (the .fab import code — cmd/controller/main.go:3517-3530
SaveEncryptedAppConfig, stacks/family_gate.go:173-190 — read the same at 0.336.0, 7ca59e2). Architecture: 09 §3
decisions 63/64 (the family gate), 221 (Glance only behind it), 07 §6.6 („never open by default").
| UTC | act (the dashboard's own endpoints) | observed (a stranger's GET through traefik; the gate file on disk) |
|---|---|---|
| 10:48:52 | POST /api/stacks/glance/deploy |
running, app_config.family_gate set |
| 10:49:34 | control | gate file traefik/dynamic/family-gate-glance.yml present; stranger → 401 |
| 10:49:35 | POST /api/export/start (stop ticked, no password) |
glance_20261020-104935.fab, 5.6 KB |
| 10:50:09 | stop + POST /api/stacks/glance/remove (data + backups) |
removed; 10:50:29 „removed the family-gate file of an app that is not installed" |
| 10:54:26 | POST /api/export/import (the household's „Importálás") |
import done in 6 s; app running |
| 10:56:13 | the app's record | app_config keys: deployed, deployed_at, desired_state, env, installed_images, locked_fields — no family_gate |
| 10:56:55 | fault | gate file none; stranger → 200 (Glance answers anyone who reaches the address) |
The first run's bundle-list parse was a harness slip (01-run.log, step 4 sent an empty path → 400, nothing done);
step 4 re-ran alone with the path the export's own status gave (02-import.log, step4.py). Teardown
(03-teardown.txt): Glance removed through the product, the bundle deleted (own file), no container, volume or gate
file left; the address answers 404.
On a household box the address is reachable from the internet through the tunnel. Family-gated apps in the catalog: Glance, Grimmory, MeTube (the last two hold the family's books and videos).