docs: the tunnel is the feature, not a footnote - #11
Merged
Conversation
`paddock tunnel` is what makes paddock worth installing — the dashboard on `127.0.0.1` is only half of it — and the README had it third in the install steps, after the detached verbs, and described in "from your phone" as "the shortcut" beneath the durable Cloudflare Access setup. So the one command that demonstrates the product read like an aside. It now comes directly after the first `paddock`, as the step to take next, and it opens "from your phone" with the Zero Trust setup behind it as the answer for anything lasting. A feature bullet names it too. Two things the ordering has to say out loud, both verified against the code rather than assumed: - `paddock tunnel` SERVES the dashboard itself, so it refuses to start beside a running instance — its preflight checks for one. The README now says to `ctrl+c` the foreground `paddock` first, and that a detached `paddock start` needs `paddock stop`. Following the old order landed on a refusal. - The pairing code is NOT one-time, which the README claimed in three places. `Pairing.attempt` mints a session on a correct code and leaves the code standing: it is valid for CODE_TTL_MS (10 minutes) and then rotates, pairs any number of devices inside that window, and burns early only after MAX_ATTEMPTS (5) WRONG guesses. "One-time" invites the reader to treat a leaked code as spent, when for ten minutes it is a password. Stated as what it is, next to the warning about the URL being public. The security framing keeps its prominence rather than being softened to sell the feature: a quick tunnel cannot have Access in front of it, the code is the only gate there is, and the URL is public until it is closed. README only — no code, no version bump. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
paddock tunnelis what makes paddock worth installing — the dashboard on127.0.0.1is only half of it — but the README had it third in the installsteps, after the detached verbs, and described it in from your phone as "the
shortcut" beneath the durable Cloudflare Access setup. The one command that
demonstrates the product read like an aside.
What changed
paddock tunnelnow comes directly after the firstpaddock, framed as the step to take next.the answer for anything lasting.
Two corrections the reordering forced
Both checked against the code, not assumed:
paddock tunnelserves the dashboard itself, so it refuses to start besidea running instance — its preflight looks for one. The README now says to
ctrl+cthe foregroundpaddockfirst, and that a detachedpaddock startneeds a
paddock stop. Following the old order landed the reader on arefusal.
The pairing code is not one-time, which the README claimed in three places.
Pairing.attemptmints a session on a correct code and leaves the codestanding:
CODE_TTL_MS= 10 minutes, then it rotatesMAX_ATTEMPTS= 5 wrong guesses"One-time" invites the reader to treat a leaked code as already spent, when for
ten minutes it is a password. Now stated as what it is, beside the existing
warning that the URL is public.
The security framing keeps its prominence rather than being softened to sell
the feature: a quick tunnel cannot have Access in front of it, the pairing code
is the only gate there is, and the URL is public until it is closed.
README only — no code, no version bump.
🤖 Generated with Claude Code