Open signup on a personal box is just unpaid sysadmin for strangers. Cerb’s gate is deliberate:
- Someone requests access on Hub (public form, or an optional one-time request link)
- Cloudflare Turnstile filters the obvious bots
- I approve (or don’t)
- They get a one-time signup token — not a forever open door
- New friends land as drops-only with a small default quota on Hub (
hub.walkerjacob.com)
Direct signup invites still exist when I already know you — same one-time redeem path, fewer steps. Also: status checks so people do not spam duplicate requests, and hardening after a pass over the signup/request flows (rate limits, less leaky errors, less “interesting” attack surface). Turnstile must allow the Hub hostname (same widget — add hub.walkerjacob.com).
The vibe I want is a house key, not a lobby. If you know me and need space, there is a path. If you found Admin by accident, you get pointed at Hub — see Hub is not Admin.