**Bead** `7049c694-e45b-4116-a887-49e64885ac8e` · [canonical URI](https://redfish.acequia.io/guerin/.agents/7049c694-e45b-4116-a887-49e64885ac8e/) · discussion: Talk: Home Port Forward Hosting This page is the wiki facet of a [bead](https://redfish.acequia.io/guerin/.agents/); the bead is the source of truth.
## Identity - **URI:** https://redfish.acequia.io/guerin/.agents/7049c694-e45b-4116-a887-49e64885ac8e/ - **Local origin:** `sites/redfish.acequia.io/guerin/.agents/7049c694-e45b-4116-a887-49e64885ac8e/` - **GUID:** `7049c694-e45b-4116-a887-49e64885ac8e` - **Slug:** `home-port-forward-hosting` - **Created:** 2026-06-13 - **Currently animated by:** CE (Claude Code extension), invoked by Stephen Guerin - **Invoked by parciante:** Stephen (Stephen@redfish.com)
## Motivation (Why a GUID) This bead exists to **document, as a reusable runbook, the pattern of hosting a public domain from a home machine behind a residential connection** — dynamic-DNS, port forwarding, and a local reverse proxy doing automatic SSL/TLS. It is a *thread-of-work / design-task* bead: the deliverable is a vetted runbook plus a worked first example. **First worked example:** `https://stephenguerin.live/`. The standing infrastructure docs ([hostgo-domains.md](https://redfish.acequia.io/guerin/.agents/), [remote-access.md], [site-inventory.md]) describe HostGo/cPanel-hosted domains served from the Acequia CDN origins. This bead covers the *opposite* topology: a domain whose A record points at a **home** IP, served by a local Node process behind **Caddy**, reached through a **port-forwarded** home router. It is the concrete, infrastructure-level instance of the recurring ecology theme that a node on a residential line is a first-class origin in the mesh.
## Mechanism (What this bead does) **Goes here:** the architecture diagram, the step-by-step runbook (DNS / dyndns, router port-forward, Caddy reverse-proxy + ACME TLS, the Node origin), the lockout-risk analysis, the credentials map (by reference, never secrets in-tree), and the verification checklist. As each component is actually executed (with Stephen's go-ahead), its status and the exact commands/responses are recorded here. **Does NOT go here:** secrets (tokens, passwords — those stay in `.credentials/`); the actual site content of `stephenguerin.live` (that is its own site folder); changes to other domains' DNS zones. **Posture:** this bead opened in a turn where Stephen *asked whether* the full chain (dyndns → Node → UPnP port-forward → Caddy TLS) was feasible and cautioned "careful not to get locked out." That was read as a feasibility question, not an execute order. So the bead currently holds the **plan and the runbook**, and records which steps are PROPOSED vs DONE. No DNS/router/Caddy mutation is performed without an explicit imperative.
## Folder Layout ``` 7049c694-e45b-4116-a887-49e64885ac8e/ ├── about.md # this file ├── README.md # front-door sidecar ├── uploads/ │ └── README.md # inbound dock └── 2026-06-13/ ├── notes/ │ └── 00-home-port-forward-hosting.md # the runbook + architecture (read first) ├── skills/ # (empty; a dyndns-updater skill may land here) ├── chats/ │ └── 2026-06-13-home-port-forward-hosting.md └── artifacts/ # (empty; Caddyfile / updater script land here when built) ```
## Session Log - **2026-06-13 — bead opened (CE, for Stephen).** Seeded `about.md` + runbook note `00-home-port-forward-hosting.md` + chat log. Established facts captured: registrar = GoDaddy; nameservers = `ns1/ns2.hostgo.com` (so the zone is editable via HostGo cPanel); cPanel API token present (`acequia.io-cpanel-token.json`, account `acequia` on HostGo); home public IP at open = `174.56.31.65` (residential, dynamic); Caddy installed via winget and on PATH; existing `C:\caddy\caddyfile.txt` already maps `stephenguerin.live → reverse_proxy localhost:3500` and `wiki.harvardviz.live → localhost:3000`; nothing currently listening on 80/443/3500. **No DNS/router/Caddy changes made** — runbook only, awaiting Stephen's go-ahead per component. - **2026-06-13 — stage 0 live.** Read-only DNS verify showed the chain was mostly already built: `stephenguerin.live` A-record already → home IP (`174.56.31.65`, edited today), Caddy already running (PID 7500) on 80/443 with a valid cert, Google Nest already forwarding 80/443 (proven by `wiki.harvardviz.live` serving from home). Only the `:3500` origin was missing (502). Stood up [`origin-server.mjs`](2026-06-13/artifacts/origin-server.mjs) placeholder on `127.0.0.1:3500` → **`https://stephenguerin.live/` now returns 200 with valid TLS.** Corrected an earlier false "nothing listening" reading (`Get-NetTCPListener` silently absent in this shell; `netstat` is authoritative). Also found cPanel UAPI blocked by Imunify360 from this IP (affects only *future* automated dyndns, not today). Outstanding: persistence (origin is session-scoped, needs a boot service); stage 1 (bead-tree server). - **2026-06-13 — hatched a child bead.** Scaffolded the purpose-built router/handler bead [`82bd6fa4-4d5a-435b-9deb-ca930a82aa89`](https://redfish.acequia.io/guerin/.agents/82bd6fa4-4d5a-435b-9deb-ca930a82aa89/about.md) (slug `stephenguerin-live-router`); **this bead is its birth-parent.** It holds the agent-face (`agent.md`/`agent.json`) + a tested deterministic rung-0 `handler.mjs` to be served at `stephenguerin.live:3500` once its `server.js` runtime is built. Obligation (advanced wave): rear what it hatches. - **2026-06-13 — stage-1 GO-LIVE.** The child bead's generic `server.js` runtime was built, tested, and the `stephenguerin-live-origin` NSSM service re-pointed from the stage-0 placeholder to `node server.js <child-bead> 3500`. **`https://stephenguerin.live/` now serves the child router-bead's agent-face** over Caddy TLS. Also added the dyndns + registry-gap doc ([03-dynamic-dns.md](2026-06-13/notes/03-dynamic-dns.md)). The full home-port-forward chain is complete and boot-persistent.
## Modus Operandi (How to interact) - **Read first:** `2026-06-13/notes/00-home-port-forward-hosting.md` — the runbook. - New working concepts → `notes/`. Polished deliverables (final Caddyfile, dyndns updater script) → `artifacts/` (or `skills/` if reusable). Verbatim chat → `chats/`, incrementally. - Cross-bead references use absolute `https://` URIs. - **Do not** write into other sites' trees, other beads' private dirs, or `.credentials/` from here. Generated config is *offered*; mutation of DNS/router/live services requires an explicit imperative from Stephen each time.
## Capabilities This bead can be cited for: the home-port-forward hosting pattern; the cPanel dyndns approach for a HostGo-managed zone; Caddy-as-local-ACME-reverse-proxy on Windows; the residential-IP-as-origin lockout-risk checklist. It does **not** itself hold credentials or run services.
## Lifecycle - **Energization:** charged while the `stephenguerin.live` home-hosting setup is being designed, stood up, or debugged; recharged whenever another domain is added to the same pattern. - **Apoptosis:** fades to reference once the runbook is complete and at least one domain is verified live and stable. If the pattern is later generalized into a standing `.ai/` doc, this bead becomes the provenance and the standing doc becomes canonical.
## Limitations - This bead is a **runbook and provenance record**, not a live service and not a secret store. - Facts captured (public IP, listening ports, what is/isn't running) are a **snapshot of 2026-06-13** — the residential IP in particular drifts; verify before acting. - The lockout analysis is advisory; the operator (Stephen) owns the go/no-go on each mutating step.
## Related beads / docs - Infra: [.ai/hostgo-domains.md](https://redfish.acequia.io/), [.ai/remote-access.md], [.ai/site-inventory.md] (HostGo/cPanel + the Acequia origins; this bead is the residential-origin counterpart). - Bead protocol: [`.agents/beads.md`](https://redfish.acequia.io/guerin/.agents/beads.md).
## References (bead cross-links) - Bead: Stephenguerin.live Router Bead · [canonical](https://redfish.acequia.io/guerin/.agents/82bd6fa4-4d5a-435b-9deb-ca930a82aa89/)
See all: Beads