FrameBridge public origin on GERANAS
This deployment template extends the existing nginx public origin. Render the two IPv4 placeholders with the selected GERANAS LAN address and CLOUD proxy address, then verify the complete rendered config before applying it. The existing loopback origin and private Tailscale HTTPS route are retained.
The new LAN socket serves the same website, downloads, signed APT indexes and existing Gitea routes. Its access list permits only the CLOUD proxy and loopback requests. The MCP, authentication and broker services are outside this server.
The public client connection terminates HTTPS at CLOUD. CLOUD connects to this origin over the trusted local network using HTTP, matching the existing local reverse proxy architecture. This configuration does not claim end-to-end TLS. Release signatures and pinned package hashes remain independently verifiable.
Deployment: preserve the existing config and a verified public generation, compare the intended four-line diff, run nginx -t against the rendered config, and signal only framebridge-web.service's nginx master with HUP. If validation fails, restore the preserved config and signal HUP again. Check loopback access, CLOUD access and denial from a different LAN client. Do not change firewall rules, Tailscale policy, DNS, certificates or other services as part of this template.
The product release source and signed v0.3.3 tag remain at a52625219e. This operations branch records only the web-origin deployment configuration.