Add explicit safe exposure modes

[woltspace-jerpint]

Summary

• replace the implicit tunnel boolean with explicit off, temporary, and authenticated exposure modes
• default fresh installs to off and bind Docker publishing to 127.0.0.1
• add woltspace exposure status/off/temporary/authenticated with automatic restart when running
• preserve WOLTSPACE_PUBLIC_TUNNEL behavior for existing installations
• fail closed when authenticated mode lacks named-tunnel configuration
• document Cloudflare Quick Tunnel versus named tunnel plus Access, while keeping the mode model provider-neutral

Security behavior

• temporary is explicitly described as unauthenticated
• authenticated requires named-tunnel credentials and reminds operators that Access is configured externally
• invalid modes resolve to off
• existing installations do not silently change exposure during upgrade

Validation

• 109 relevant tests passed
• 11 new exposure resolution and host CLI tests
• bash syntax checks passed for woltspace and container/start.sh
• git diff --check passed

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
woltspace	Ready	Preview, Comment	Jul 22, 2026 10:02pm