Local network environment

The authorized private lab uses a bounded copy of real canonical data on minipc and a gateway on realme, with iMac as the client. It is separate from the complete iMac corpus and does not imply a public production service. Its named release is lan-20261002-v1, pinned to epoch 36250; do not substitute full-corpus counts.

The declared census is1200 matches, selected as100 per discipline and season. Partial or unknown coverage remains explicit. These are bounded lab counts, not a complete calendar or a claim of verified-complete PBP.

Documentation keeps https://api.datafortennis.com as the normal API address. Local clients explicitly map it to the gateway while retaining hostname checks. The operator supplies the gateway port, lab CA, client certificate/key, protected Bearer config and deployed release receipt.

curl --noproxy '*' --fail-with-body \
  --config "$DFT_CLIENT_CONFIG" \
  --cacert "$DFT_LAB_CA" \
  --cert "$DFT_LAB_CLIENT_CERT" \
  --key "$DFT_LAB_CLIENT_KEY" \
  --connect-to "api.datafortennis.com:443:192.168.1.82:$DFT_LAB_GATEWAY_PORT" \
  https://api.datafortennis.com/v1/releases

This routes to the LAN address while TLS verifies api.datafortennis.com. Do not use --insecure, alter public DNS or expose the PostgreSQL listener. The TLS client identity and API Bearer credential are separate requirements.

The intended traffic path is client -> realme gateway -> minipc origin -> private API -> loopback PostgreSQL. SSH/Tailscale can control the machines but is not the LAN API data path. Both Windows machines use native Linux x86_64 WSL runtimes.

Readiness and local troubleshooting

The gateway connection override uses port55881. Minipc’s origin is a separate private LAN listener; PostgreSQL and the application listener stay on loopback. The firewall admits only the authorized iMac client. Keep the lab CA and client certificate/key in protected files, separate from the API Bearer credential.

--noproxy '*' prevents an inherited system proxy from routing a local diagnostic outside the lab. It does not disable TLS validation. SSH/Tailscale remain control channels, while the API request uses the local network addresses.

The supervised Linux services run in WSL. After a Windows restart, the operator must ensure the distro is running and verify the realme NAT forwarding address before client smoke. Do not assume an enabled systemd service proves Windows boot availability. Certificates and lab API credentials need rotation before their expiration; the current lab material was issued with a30-day lifetime.

Check both health endpoints and an authenticated release/match read after any switch. Readiness can temporarily return503 during pool pressure or cancellation; liveness has a separate contract. A transient gateway503 may represent a lost response. Preserve the same canonical request and Idempotency-Key on a bounded retry; never change filters while reusing the key. Do not treat an ambiguous transport result as proof that the server did no work.

The operator receipt in the backend repository records exact commit, native test results, DB size, full lab traversal, measured load, service identities and rollback. Internet availability, public RapidAPI access and VPS capacity remain unverified by these private tests.