h.v.bzh

This host is not a website. It is the canonical ingress point for the kisakay home network. If you got here by typing h.kisakay.com in a browser, everything is working as intended. There is nothing else to click.

1. What this node is

• Canonical name: h.v.bzh -- single public entry for this network
• Role: all hosted domains point here. Standard pattern:

    CNAME <domain> -> h.v.bzh
  

• Edge: CDN proxied (orange-cloud). Clients talk to the edge, the edge talks to the origin.
• Transport: edge traffic is forwarded to the home over an encrypted tunnel (with source NAT + MSS clamp).
• Termination: home NixOS nginx terminates TLS (ACME) and routes per Host. No backend port is exposed directly.

2. Routing policy

Consequence operators should know: the origin only ever sees the tunnel gateway as source (post-NAT). The true client IP is lost at L3 -- there is no forwarded-for injected by the packet filter. If the real client IP is ever needed in logs, the current L3 forwarding must become a L7 reverse-proxy with PROXY protocol on the relay side.

3. About /api/ on this host

https://h.v.bzh/api/ is the game-server control channel (served locally on loopback, TLS terminated at the edge of this box, websocket console). It is for servers managed by the panel -- not for browsers, not for curl tourism. No daemon port is exposed directly and file access stays LAN-only. GET / intentionally returns this page; only /api/ speaks the daemon.

4. Peering / contact

• No peering requests. No open relay. No exceptions.
• Abuse originating from this network: check your Received: headers first, then contact the edge provider -- this box is behind NAT and CF by design.
• Operators: see the internal runbooks (packet walk, vhost table, firewall policy).