> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.datafortennis.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.datafortennis.com/_mcp/server.

# Local network environment

The authorized private lab uses a bounded copy of real canonical data on minipc
and a gateway on realme, with iMac as the client. It is separate from the complete
iMac corpus and does not imply a public production service. Its named release is
`lan-20261002-v1`, pinned to epoch `36250`; do not substitute full-corpus counts.

| Lab release surface | Singles | Doubles |
| --- | --- | --- |
| Matches, seasons2021–2026 | 600 | 600 |
| Accepted point rows | 41,686 | 60,088 |
| Match/set metric rows | 10,166 | 41,879 |

The declared census is1200 matches, selected as100 per discipline and season.
Partial or unknown coverage remains explicit. These are bounded lab counts,
not a complete calendar or a claim of verified-complete PBP.

Documentation keeps `https://api.datafortennis.com` as the normal API address.
Local clients explicitly map it to the gateway while retaining hostname checks.
The operator supplies the gateway port, lab CA, client certificate/key, protected
Bearer config and deployed release receipt.

```sh
curl --noproxy '*' --fail-with-body \
  --config "$DFT_CLIENT_CONFIG" \
  --cacert "$DFT_LAB_CA" \
  --cert "$DFT_LAB_CLIENT_CERT" \
  --key "$DFT_LAB_CLIENT_KEY" \
  --connect-to "api.datafortennis.com:443:192.168.1.82:$DFT_LAB_GATEWAY_PORT" \
  https://api.datafortennis.com/v1/releases
```

This routes to the LAN address while TLS verifies `api.datafortennis.com`. Do not
use `--insecure`, alter public DNS or expose the PostgreSQL listener. The TLS
client identity and API Bearer credential are separate requirements.

The intended traffic path is client -> realme gateway -> minipc origin -> private
API -> loopback PostgreSQL. SSH/Tailscale can control the machines but is not the
LAN API data path. Both Windows machines use native Linux x86_64 WSL runtimes.

## Readiness and local troubleshooting

The gateway connection override uses port55881. Minipc's origin is a separate
private LAN listener; PostgreSQL and the application listener stay on loopback.
The firewall admits only the authorized iMac client. Keep the lab CA and client
certificate/key in protected files, separate from the API Bearer credential.

`--noproxy '*'` prevents an inherited system proxy from routing a local diagnostic
outside the lab. It does not disable TLS validation. SSH/Tailscale remain control
channels, while the API request uses the local network addresses.

The supervised Linux services run in WSL. After a Windows restart, the operator
must ensure the distro is running and verify the realme NAT forwarding address
before client smoke. Do not assume an enabled systemd service proves Windows
boot availability. Certificates and lab API credentials need rotation before
their expiration; the current lab material was issued with a30-day lifetime.

Check both health endpoints and an authenticated release/match read after any
switch. Readiness can temporarily return503 during pool pressure or cancellation;
liveness has a separate contract. A transient gateway503 may represent a lost
response. Preserve the same canonical request and Idempotency-Key on a bounded
retry; never change filters while reusing the key. Do not treat an ambiguous
transport result as proof that the server did no work.

The operator receipt in the backend repository records exact commit, native test
results, DB size, full lab traversal, measured load, service identities and
rollback. Internet availability, public RapidAPI access and VPS capacity remain
unverified by these private tests.