docs: expose photocapture publicly via Cloudflare Tunnel at photo.designerwallcoverings.com (Mac-bound; CF edge TLS for camera)

7bb65214bbd9f7a06f517e89a27233828880c8b6 · 2026-07-06 14:28:07 -0700 · Steve Abrams

Files touched

M .gitignore
A ACCESS.md

Diff

commit 7bb65214bbd9f7a06f517e89a27233828880c8b6
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Jul 6 14:28:07 2026 -0700

    docs: expose photocapture publicly via Cloudflare Tunnel at photo.designerwallcoverings.com (Mac-bound; CF edge TLS for camera)
---
 .gitignore |  2 ++
 ACCESS.md  | 26 ++++++++++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/.gitignore b/.gitignore
index abc9d57..9aa1968 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,5 @@ data/progress.json
 .DS_Store
 certs/
 data/mfr_index.json
+tunnel.out.log
+tunnel.err.log
diff --git a/ACCESS.md b/ACCESS.md
new file mode 100644
index 0000000..dc62e7c
--- /dev/null
+++ b/ACCESS.md
@@ -0,0 +1,26 @@
+# Access — dw-photo-capture
+
+This app is **Mac-bound by design** (macOS Vision OCR binary `bin/ocr` + local Ollama VLM +
+Homebrew psql), so it runs on this Mac (macstudio3), NOT on Kamatera. It is exposed publicly
+via a **Cloudflare Tunnel** — the Mac stays the compute; Cloudflare's edge provides the real
+TLS the live camera (`getUserMedia`) needs.
+
+## URLs
+- **Public:** https://photo.designerwallcoverings.com  (Cloudflare edge TLS; basic-auth gated)
+- **LAN:** https://192.168.1.151:9891  (self-signed)
+- **Tailscale:** https://100.82.17.107:9891
+- **Local:** http://localhost:9890
+
+## Serving stack
+- **App:** launchd `com.steve.dwphoto` (PID varies) — `server.js`, HTTP :9890 + self-signed HTTPS :9891.
+- **Tunnel:** launchd `com.steve.dwphoto-tunnel` → cloudflared, config `~/.cloudflared/dwphoto-config.yml`,
+  tunnel id `ba44dc91-81cf-4c89-ae3e-fa5fc347eb1b`, ingress `photo.designerwallcoverings.com → http://localhost:9890`.
+  (Origin is plain HTTP :9890 on purpose — CF terminates TLS at the edge, avoiding the app's self-signed cert.)
+- **Auth:** HTTP Basic (admin / DW2024! by default; override via AUTH_USER/AUTH_PASS env).
+
+## Ops
+- Tunnel logs: `tunnel.out.log` / `tunnel.err.log` (repo root, gitignored).
+- Restart tunnel: `launchctl kickstart -k gui/$(id -u)/com.steve.dwphoto-tunnel`
+- Remove tunnel: `launchctl bootout gui/$(id -u)/com.steve.dwphoto-tunnel` + `cloudflared tunnel delete dwphoto`
+- **A true Kamatera (Linux) deploy is NOT possible without re-architecting** OCR → cloud API
+  (Google Vision/Gemini, metered) and Ollama → a remote host.

← ea390e5 chore: macstudio3 migration — reconcile from mac2 + repoint · back to Dw Photo Capture · feat: pluggable vision engines (macvision|gemini|gcv), runti 75c75e3 →