Public API/edge endpoint: http://74.48.78.17:16667
Public browser endpoint: http://74.48.78.17:16666
hwlab-tunnel-client owns the frp client health contract.
hwlab-cloud-web owns the public browser entry on port 16666.
hwlab-edge-proxy owns public API/health ingress on port 16667.
frps.dev.toml reserves D601 16666 / 16667, G14 17666 / 17667, and tunnel health 7402 as TCP remotePort values; do not also bind them as vhostHTTPPort, because that collides with the DEV TCP proxy.
deploy/deploy.json is the source for the public endpoints and FRP proxy mapping. Run node scripts/deploy-contract-plan.mjs --check to detect drift such as public 6666/6667 reuse before any future apply command.
No secret values are stored in this repository. Operators must provide auth material out of band before a real deployment.
UniDesk backend, provider-gateway, and microservice proxy are not HWLAB runtime substitutes.

G14 public preview

G14 uses a separate preview port range and must not reuse D601's 16666 / 16667:

G14 browser endpoint: http://74.48.78.17:17666
G14 API/edge endpoint: http://74.48.78.17:17667
G14 frpc proxy names: hwlab-g14-cloud-web and hwlab-g14-edge-proxy
G14 k3s Deployment: hwlab-dev/hwlab-g14-frpc, generated by scripts/g14-gitops-render.mjs
Master frps allow-list template: deploy/frp/frps.dev.toml
G14 frpc local template: deploy/frp/frpc.g14.toml

Only hwlab-cloud-web:8080 and hwlab-edge-proxy:6667 are exposed through FRP. Internal services, Tekton, Argo CD, registry, database, and simulator services stay ClusterIP-only. The master-side /opt/hwlab-frp/frps.dev.toml may need a manual allow-list update matching deploy/frp/frps.dev.toml before the G14 frpc Deployment can register 17666 and 17667; this is an edge operation, not a D601 client change.