BryanNetStable public callbacks with private local admin
Prerequisites and authority
Local installation authority, a complete approved release package, working Docker and access to the deployment record are required. Preserve existing data before installation/update/removal.
Separate public callbacks from private administration
A local BryanNet installation may keep its admin interface on a private network while exposing only the stable HTTPS routes needed for customers and provider callbacks. Define the intended exposure explicitly rather than publishing every host port.
| Path | Intended audience | Requirement |
|---|---|---|
| Administrator interface | Authorized staff | Authentication and controlled access |
| Customer interface | Entitled customers | HTTPS and correct API links |
| Provider callbacks | Payment provider | Public reachability and server-side event verification |
| Router event receiver | Managed routers, where used | Reachability plus router authentication |
| MySQL / RouterOS API | Management services | Private LAN/VPN access |
Configure ingress routes using the actual callback paths generated by the release. Do not invent a broad unauthenticated API exception. Provider events must still undergo their required signature/verification checks.
Test from outside the site: the callback should be reachable, the administrator path should follow the selected access policy, and MySQL/RouterOS API should remain inaccessible publicly. Follow the event through payment and subscription records.
A managed BryanNet webhook relay is a future idea and is outside current functionality. A stable tunnel or supported reverse proxy is required when the customer-hosted installation needs external callbacks today. Keep its hostname and service configuration in the recovery plan.
Optional assistance by separate agreement
An organization may request help establishing a stable subdomain and a persistent HTTPS route to its own installation, for example a separately agreed siteabc.bryannet.online hostname. This is limited setup assistance, not an automated feature, central webhook relay or included managed-hosting service. The exact webhook paths still come from the installed release, not from this hostname example.
Agree ownership and access, the permitted public paths, certificate/tunnel renewal, restart behavior, handover and the end of the assistance before configuration. A customer can use another provider or its own domain instead. Do not publish administrator routes, databases or router-management ports as part of a callback-only arrangement. Keep tunnel credentials outside BryanNet's application backup and retain them securely in the site's separate infrastructure recovery record.
Related guides
Related guides: First-deployment walkthrough and success checklist, Deployment verification and first login, Back up BryanNet and validate backups, Restore BryanNet safely, Product updates, compatibility and rollback.