dreampiler/kandev
1
0
Fork 0
Code Issues 43 Pull Requests Actions 6 Packages Projects Releases Wiki Activity

docs: add branded diagram design guidance (#3316)

Browse Source
This commit is contained in:
Carlos Florêncio
2026-09-03 23:12:45 +00:00
committed by GitHub
parent 767d8b2d16
commit 34b8eafabf
276 changed files with 43250 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/public/mobile-remote-access.md
+9 -16
View File
@@ -13,23 +13,16 @@ Anyone who can reach an unauthenticated Kandev origin has administrator access.
Each protected path reaches the same Kandev origin. Kandev then sends task work to the selected executor.
```mermaid
flowchart LR
Phone["Phone browser"]
Tailscale["Tailscale Serve"]
Cloudflare["Cloudflare Access"]
Cloudflared["cloudflared"]
VPN["Private VPN"]
Kandev["Kandev<br/>HTTP and WebSocket"]
Session["Task and agent session"]
Executor["Selected executor"]
Repo["Repository"]
![Mobile remote access architecture: a phone reaches one Kandev origin through Tailscale Serve, Cloudflare Access with cloudflared, or a private VPN, then Kandev routes the task session to the selected executor and repository.](../screenshots/mobile-remote-access.svg)
Phone --> Tailscale --> Kandev
Phone --> Cloudflare --> Cloudflared --> Kandev
Phone --> VPN --> Kandev
Kandev --> Session --> Executor --> Repo
```
[Open full-size SVG diagram][mobile-remote-access-diagram]
[mobile-remote-access-diagram]: ../../docs/screenshots/mobile-remote-access.svg
The diagram shows the important boundary: Tailscale Serve, Cloudflare Access with
`cloudflared`, and a private VPN are alternative protected paths to the same
Kandev origin. Kandev then owns the task session and routes work to the selected
executor and repository.
The access path protects the Kandev origin. Each path reaches the same Kandev web app and task features.
Kandev authentication remains a separate user and workspace boundary.