NovaTech-controlled relay
NovaFabric Relay Dashboard
The public surface is sealed. Operational telemetry, webhook relay, and operator steering appear only after a NovaTech gate token is issued. The dashboard never probes UnRaid directly.
Protected ingress
Public root, health probe, and sealed operator routes.
/dashboardOperator view with gate checks.
gate/api/pollCron-backed fleet polling entrypoint.
cron/api/webhooks/*Signed task and reply ingress.
hmacStorage split
D1 owns durable records; KV owns hot cache and replay guards.
Canonical system state, relay messages, polls, and audit history go to D1. The latest snapshot, gate nonce, and webhook dedupe markers go to KV.
Security model
Short-lived gate tokens, HMAC webhooks, and cron-only polling.
The lock is not cosmetic. The dashboard requires a signed gate token, webhooks require a secret signature, and cron polling needs a dedicated secret. The browser never gets direct host access.