# Architecture and security

## Components

| Component | Location | Responsibility |
|---|---|---|
| Dashboard | Router: `/www/streaming` | Local dashboard UI, router control, Chat host UI, overlay builders, and protected overlay feeds |
| Dashboard settings | Router: `/etc/irl-dashboard/settings.json` | Private local configuration and overlay tokens |
| Premium Chat relay | StreamHelpers: `/chat-connect` | Account entitlement, secure pairing, provider OAuth, provider message relay, and credential refresh |
| Public installer | StreamHelpers: `/irl-dashboard/irl-dashboard.tar.gz` | Current router dashboard application package |
| Development mirror | `Z:\Developer\StreamHelpers.com\irl-dashboard` | Local mirrored release and source reference |

## Trust boundaries

The dashboard browser does not receive provider refresh tokens, Stripe secrets, hosted service configuration, or the long-term pairing secret. StreamHelpers keeps provider OAuth credentials server-side. The router holds protected pairing material and only obtains short-lived provider access when the service permits it.

Overlay pages are deliberately unauthenticated so encoder browser sources can load them. Access is protected by high-entropy local overlay tokens embedded in the generated URLs. Do not publish, stream on-screen, or send these URLs to untrusted people.

## Router file permissions

The web server runs as `nobody`. The settings directory must remain private:

```text
/etc/irl-dashboard                 0700
/etc/irl-dashboard/settings.json   0600  nobody:root
```

Deploying a settings file as `root` without restoring ownership can cause PHP read failures and secondary session-header warnings. Application-file updates are safe to deploy as root; do not replace or rename the protected settings file unless the ownership and mode are restored.

## Operational security

- Set a dashboard username and password under Access.
- Keep the dashboard reachable only from a private LAN, Tailscale, or another VPN. Do not port-forward it.
- Treat the router settings file, overlay URLs, pairing links, dashboard passwords, and provider credentials as secrets.
- Use HTTPS for the StreamHelpers service and external graphics loaded by overlays.
- Keep the live router, installer archive, and local release mirror aligned before relying on an update.

## Privileged router actions

The installer grants the web user passwordless sudo only for a limited allowlist needed by router controls, including `gl_modem`, `ubus`, `dmesg`, and `srtla-bond.sh`. It does not grant unrestricted sudo. Removing `/etc/sudoers.d/irl-dashboard` revokes those capabilities while leaving the rest of the UI available.