Private is not a login state
Authentication answers who a caller is. Network structure should still decide which doors exist.
It is possible to put a login screen in front of an administrative service and still publish far more than intended.
The route exists. The origin can be probed. Middleware can be misconfigured. An authentication bug becomes a direct path to the control surface.
RS Platform treats network reachability as part of authorization. Identity still matters, but it is not asked to carry the entire boundary alone.
Classify the route before exposing it
Public applications enter through a Cloudflare Tunnel. The cluster accepts no unsolicited public connection, and private services never become tunnel routes.
Human self-service is a narrower case. An approved user may need to recover or manage their own profile before a VPN is connected, so those specific routes can be public after strong authentication and strict per-user projection.
Operator APIs are different. They require the private operator WireGuard path before the application evaluates a passkey session. From public ingress, the route is absent rather than merely unauthorized.
These are three products with three exposure contracts, even when one browser experience presents them coherently.
Use the network to express coarse policy
The overlay uses separate WireGuard interfaces for different populations and host routes for explicit destinations. A broad routed prefix would make new machines reachable as a side effect. A host route makes every reachable system a reviewed addition.
Within the human-user interface, authorization can become more precise.
Everyone receives regional egress; a game permission adds one destination and
one port for one user /32. It does not mint a second tunnel or make the VPC
generally reachable.
The firewall preserves that source address so its rule can express the real claim: this user may reach this service on this protocol and port.
Authentication and path defend different mistakes
A passkey protects against phishing and avoids a password lifecycle. It does not make a public operator endpoint desirable.
A VPN path limits exposure and gives the network a stable device route. It does not prove which human is present or whether a sensitive action should be allowed.
Using both does not magically create perfect independence—both may live on the same phone or laptop. It does create two different checks with different failure modes:
- the request arrived through an approved network path; and
- the application verified a human credential for this origin.
That is more honest than calling either one sufficient.
Default denial should survive growth
The important test is what happens when a new subnet, service, or route appears. If it becomes reachable because it fits inside a broad prefix, the network grows permission implicitly.
Exact host routes, per-interface bounds, private-range drops, and destination-specific allows make growth fail closed. New capability requires a new declaration.
Authentication decides who crossed a door. Architecture should decide whether the door was ever installed.