Networking
A Machine is reached by name on the local network, over plain HTTP, and needs nothing from outside it.
Names
| pipeos.local | every Machine answers it. One Machine on the LAN: that Machine; several: the lobby |
| pipeos-xxxx.local | the chassis id: the last four hex characters of the primary network card's address. It is the hostname, written from hardware at every boot, answered for life |
| <name>.local | the alias you gave it at claim. Renaming changes the alias and nothing else; a name a sibling uses, or that already answers on the LAN, is refused |
Machines ask for each other over mDNS every ten seconds; a new box appears in the others' lobbies within seconds, and one that stops answering goes grey with its last address and hardware address kept, which is what Wake uses. The Network view's map is the whole LAN, with the Machines marked.
When .local does not resolve
Some Android devices and some corporate networks do not resolve mDNS. Find the box in your router's DHCP table (it announces pipeos-xxxx or the name you gave it) and open http://<ip>/. Give a fresh box two minutes. From a machine that does resolve, ping pipeos.local tells you whether the name or the box is the problem.
Plain HTTP on the LAN
The dashboard's one front door is http://pipeos.local/, then http://<name>.local/, like the router's page and the printer's. What HTTPS would add on a LAN is protection of the login and the terminal against a device on the same network that can see traffic, a risk the LAN already carries for every other box in it. What a publicly trusted certificate would cost is larger: every Machine's name in public certificate logs, its private address in public DNS, every padlock depending on a relay outside your building. No page will ask you to accept a warning.
Sessions are random tokens in memory (a reboot signs everyone out), cookies are strict to the Machine's own origin, cross-origin writes are refused, and a failed login costs two seconds. The image ships unclaimed; whoever reaches the page first owns the box, which is the reason to claim it before anything else.
The box's own CA
Port 443 serves with a certificate from the Machine's own certificate authority, which is also its cluster identity. An operator who wants a padlock can install it (curl -s http://<box>/install-ca.sh | sudo sh, or /ca.crt and /pipeos-ca.mobileconfig from the box); nothing depends on it.
From outside the LAN
The Machine opens no port to the internet. Two things cross that boundary, both outbound and both switches you hold: pipe integration, DMs from anywhere, and vendor support access, a reverse tunnel that exists only while the switch is on. SSH is key-only, and root has no password.