Actors

gateway: The WebThings Gateway running on the local network.
cloud: The registration server/DNS/PageKite combo.
- All API calls to the registration server are done through TLS, assuming the server is properly configured.
- PageKite tunnels are set up with unique secret tokens for each domain.
LE: Let's Encrypt
browser: The user's web browser.
email: The user's email.

Gateway Setup

[gateway <-> browser] Start the gateway server on HTTP and load the setup UI at https://gateway.local:8080
[gateway <-> cloud] Choose an available domain name and receive the API token using /subscribe.
[gateway <-> LE] Run the Let's Encrypt DNS challenge on the gateway.
[gateway <-> cloud] Use /dnsconfig to send the LE challenge token to the registration server.
[LE <-> cloud] LE does a DNS lookup for the desired domain. Lookup is handled by registration server, and the challenge token is returned.
[gateway <-> LE] Generate the certificates, restart the server on HTTPS.
[gateway <-> cloud] (If using tunneling, rather than dynamic DNS) Gateway sets up a secure tunnel to the registration server through PageKite. This makes the gateway UI accessible through the internet, at the desired domain, with no extra effort by the user.
[gateway <-> browser] Redirect from https://gateway.local:8080 to https://mydomain.mozilla-iot.org.
[gateway <-> browser] Create the gateway admin account with an email address.
[gateway <-> cloud] Set domain's email address with /setemail.
[cloud <-> email] Registration server sends a verification email to the provided email address, with a /verifyemail link.
[email <-> browser] Domain is verified by clicking the provided /verifyemail link.
[gateway <-> cloud] Periodically ping the cloud service using /ping.
[gateway <-> LE] Service runs in the background on the gateway and auto-renews its LE certificates as necessary.

Domain Reclamation

[gateway <-> browser] Start the server on HTTP and load the setup UI at https://gateway.local:8080
[gateway <-> cloud] User chooses a domain name they've already used (determined via /subscribe) and is given the option to reclaim.
[gateway <-> cloud] Gateway calls /reclaim.
[cloud <-> email] A random reclamation token is generated and emailed to the registered email address.
[email <-> browser] User enters the reclamation token from their email into the gateway's setup UI.
[gateway <-> cloud] Gateway again calls /subscribe with the reclamation token and receives an API token.
[gateway <-> LE] Run the Let's Encrypt DNS challenge on the gateway.
[gateway <-> cloud] Use /dnsconfig to send the LE challenge token to the registration server.
[LE <-> cloud] LE does a DNS lookup for the desired domain. Lookup is handled by registration server, and the challenge token is returned.
[gateway <-> LE] Generate the certificates, restart the server on HTTPS.
[gateway <-> cloud] (If using tunneling, rather than dynamic DNS) Gateway sets up a secure tunnel to the registration server through PageKite. This makes the gateway UI accessible through the internet, at the desired domain, with no extra effort by the user.
[gateway <-> browser] Redirect from https://gateway.local:8080 to https://mydomain.mozilla-iot.org.
[gateway <-> browser] Create the gateway admin account with an email address.
[gateway <-> cloud] Periodically ping the cloud service using /ping.
[gateway <-> LE] Service runs in the background on the gateway and auto-renews its LE certificates as necessary.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!