3C is a personal control plane with powerful access. Treat it like infrastructure, not a normal website.

Public traffic should enter only through Cloudflare Tunnel.

Internet → Cloudflare → Cloudflare Tunnel → Traefik → app

Do not expose Traefik, the panel, Ollama, CompGate, or app ports directly on the Oracle host unless there is a deliberate reason.

The panel has no built-in auth. 3c.lol must be protected by Cloudflare Access.

Admin surfaces for apps should also use Cloudflare Access where practical.

The panel mounts the Docker socket:

/var/run/docker.sock:/var/run/docker.sock

This means the panel can effectively control the host. A compromised panel is a compromised server.

Mitigations:

• protect panel with Cloudflare Access;
• keep panel dependencies minimal;
• avoid exposing panel API to unauthenticated users;
• avoid arbitrary shell endpoints unless heavily gated;
• prefer explicit app/container actions over general command execution.

Never commit real secrets.

Sensitive files include:

/home/ubuntu/3c/.env
/home/ubuntu/3c/apps/*/.env
~/.config/3c/config.toml
*.db

Use .env.example for templates.

Recommended ignore patterns:

.env
apps/*/.env
*.db
__pycache__/
*.pyc

chmod 600 ~/.config/3c/config.toml

Oracle reaches home GPU services through the tailscale container and socat forwards.

CompGate should require X-API-Key for app requests. The key should be shared to apps as AI_GATEWAY_KEY and not committed.

If the home PC is gaming or unavailable, CompGate may return 503. This is expected and safer than allowing server apps to fight the user for GPU resources.

When sharing repo archives with agents or humans, avoid including:

.git/
.env
apps/*/.env
*.db
backups/
__pycache__/
.venv/

Safer archive pattern:

zip -r repo.zip . \
  -x '.git/*' \
  -x '.env' \
  -x 'apps/*/.env' \
  -x '*.db' \
  -x '*/__pycache__/*' \
  -x '*/.venv/*'