Private Dashboard Authentication Boundary

A private dashboard can use the same React interface for its owner and administrator, but it cannot trust the browser bundle to protect data. The enforcement point must sit on the server path before requests reach the application.

Keep the public and private products separate

The public site contains articles and approved portfolio evidence. Calendar records, study history, drafts, and source documents stay behind the private hostname. They are excluded from public bundles, static assets, search indexing, and client environment variables.

The tunnel targets the authentication proxy, not the app port. This detail prevents the public hostname from bypassing the guard. The ingress rule uses one exact hostname; look-alike records and old fallback domains are not accepted.

Defense continues after login

The proxy applies authentication and request limits. Private APIs return Cache-Control: private, no-store. Source-document access repeats authorization and allowlist checks rather than assuming that reaching the application is sufficient. Destructive actions remain narrow and explicit.

Live verification closes configuration drift

Process inspection confirmed that the dashboard service, proxy, and tunnel were running from the intended paths. The app port returned 200, while the proxy and public private-domain endpoint returned 401 without credentials. The tunnel configuration pointed to the proxy port and exact hostname. These checks matter because a correct template does not prove that the installed service uses it. The remaining operational requirement is periodic revalidation after credential, tunnel, or deployment changes.