case study 01 · 2025 to 2026 · sole author

A way into the PC in the back of the shop

Tally and BUSY run on a Windows PC on the shop floor, behind NAT, with no inbound ports and no authentication on their local APIs. The cloud platform had to reach them anyway, without putting a company's books on the open internet.

role: Sole authorTauri and React, end to end
shipped: To merchantssigned, auto-updating
serves: 2 ERPsone install, one hostname
stack: Tauri 2React, Cloudflare Tunnel

NAT · outbound only

platformKubernetes, Postgres

edgeCloudflare

connectorproxy on 127.0.0.1

Tally :9000or BUSY

The shop opens the tunnel outward. Nothing listens on its public IP, and every proxied call carries a per-install secret.

the claim

On paper the shop PC is unreachable. With no inbound ports, a cloud service can't call it. The ERP's own HTTP endpoint has no authentication, so simply opening a port would expose the books to anyone who found it.

what I built

A Tauri 2 desktop app with a React front end that runs a reverse proxy on localhost and supervises a bundled cloudflared sidecar, so each install gets a stable public hostname through an outbound-only tunnel.
A per-installation shared secret on every proxied call that fails closed. A missing or wrong header never reaches the ERP.
Tokens in the OS keychain, raw TCP health probes on the local ERP ports, and a live diagnostics page backed by a ring buffer.
Signed Windows installers with verified auto-update, and Windows job objects so a crashed app can't leave a tunnel running that blocks the next update.

what else lied

The keychain. The keychain library ships with no platform backend enabled. A bare dependency compiles a mock store that accepts writes and returns nothing on read, so tokens never persisted. The fix was enabling the native backend for each platform explicitly.

The network. cloudflared dials the edge over QUIC on UDP 7844. Client networks that drop UDP left it stuck on "Connecting" forever, with nothing wrong on the PC itself. The connector now runs the tunnel over HTTP/2.

what changed

One install serves two ERPs over one hostname. Changing an ERP port repoints the gateway without restarting the tunnel, and reconnects back off at 2, 5, 10, 30 and 60 seconds. It ships to merchants as a signed installer that updates itself.