docs: add network hub + pairing locality

This commit is contained in:
Peter Steinberger
2026-01-21 00:14:06 +00:00
parent e083f678fd
commit e5ea8a0d22
5 changed files with 75 additions and 0 deletions

View File

@@ -195,6 +195,8 @@ The Gateway treats these as **claims** and enforces server-side allowlists.
- Gateways issue tokens per device + role.
- Pairing approvals are required for new device IDs unless local auto-approval
is enabled.
- **Local** connects include loopback and the gateway hosts own tailnet address
(so samehost tailnet binds can still autoapprove).
- All WS clients must include `device` identity during `connect` (operator + node).
- Non-local connections must sign the server-provided `connect.challenge` nonce.