@@ -1414,33 +1414,66 @@ flow writes both through the daemon, so a client never has to know the path.`,
 		Long: `Serves two things on one listener: a tunnel at /v1/socket that carries the
 whole JSON-RPC surface unchanged, and a health endpoint at /v1/health.
 
-The listener is a UNIX SOCKET. A tcp:// address is refused rather than
-quietly downgraded: the authenticators and bind-address checks that would
-make a port safe are not built yet, and a unix socket inherits the same
-"you had to be me to reach it" argument the angelus socket already rests on.
-Put Caddy (or any reverse proxy) in front of the socket to reach it from a
-network.
+WHICH AUTHENTICATOR MAY SERVE WHICH ADDRESS is a table, and it is checked
+against the address the kernel ACTUALLY bound -- not the string you typed,
+because ":9090", "0.0.0.0" and "::ffff:127.0.0.1" all defeat a config parse.
+
+  authn=none      unix socket only. Anyone who reaches the port is an admin.
+  authn=upstream  unix or loopback. Trusts Remote-User/Remote-Groups, which
+                  only a reverse proxy on the same box should be able to set.
+  authn=doorkey   anywhere, but plaintext TCP needs --tls-terminated.
+
+A refused combination does not start. Loopback is not a principal boundary:
+every local uid reaches it, and a published container port or an ssh -L tunnel
+re-exposes it. Where that is not enough the answer is a credential.
 
 Browser origins are DENIED by default. CORS does not apply to WebSocket
 upgrades, so a page carrying an ambient session cookie could otherwise open
-a tunnel and speak raw JSON-RPC; --origin is the opt-in.
+a tunnel and speak raw JSON-RPC; --origin is the opt-in. On any TCP bind set
+--host too, or a browser reaches you by DNS rebinding.
+
+TUNNELS ARE CAPPED (8h by default on TCP). Forward authentication happens on
+the upgrade request only: once a WebSocket is established no frame is ever
+re-authorized, so a revoked operator keeps a live shell until the socket
+drops. The cap forces a re-upgrade, and a re-upgrade is re-authorized.
 
 serve does not start the daemon. It fronts one that is already running.`,
-		Usage: "serve [--listen unix:///path] [--origin <url>[,<url>]]",
+		Usage: "serve [--listen <uri>] [--authn <n>] [--doorkey-file <p>] [--origin <urls>] [--host <names>]",
 		Flags: []cmdkit.FlagDef{
-			{Long: "listen", Description: "unix:///path to bind (default: gateway.sock beside the angelus socket)"},
+			{Long: "listen", Description: "unix:///path or tcp://host:port (default: gateway.sock beside the angelus socket)"},
+			{Long: "authn", Default: "none", Description: "none | upstream | doorkey"},
+			{Long: "doorkey-file", Description: "File holding the shared secret for --authn doorkey"},
 			{Long: "origin", Description: "Comma-separated browser origins allowed to open a tunnel"},
+			{Long: "host", Description: "Comma-separated Host: header allowlist (set this on any TCP bind)"},
+			{Long: "tls-terminated", IsBool: true, Description: "Assert that something in front terminates TLS"},
+			{Long: "max-conn-age", Description: "Cap one tunnel's lifetime, e.g. 8h. Forces re-authorization (default 8h on TCP)"},
 		},
 		Run: func(ctx *cmdkit.RunContext) error {
-			var origins []string
-			if o := ctx.Flag("origin"); o != "" {
-				for _, s := range strings.Split(o, ",") {
+			split := func(v string) []string {
+				var out []string
+				for _, s := range strings.Split(v, ",") {
 					if s = strings.TrimSpace(s); s != "" {
-						origins = append(origins, s)
+						out = append(out, s)
 					}
 				}
+				return out
+			}
+			o := ServeOpts{
+				Listen:      ctx.Flag("listen"),
+				Authn:       ctx.Flag("authn"),
+				DoorkeyFile: ctx.Flag("doorkey-file"),
+				Origins:     split(ctx.Flag("origin")),
+				Hosts:       split(ctx.Flag("host")),
+				TLSDone:     ctx.BoolFlag("tls-terminated"),
+			}
+			if v := ctx.Flag("max-conn-age"); v != "" {
+				d, err := time.ParseDuration(v)
+				if err != nil {
+					return fmt.Errorf("--max-conn-age: %w", err)
+				}
+				o.MaxConnAge = d
 			}
-			return runServe(mustLoadConfig(), ctx.Flag("listen"), origins)
+			return runServe(mustLoadConfig(), o)
 		},
 	})
 
 
@@ -13,7 +13,9 @@ import (
 	"os"
 	"os/signal"
 	"path/filepath"
+	"strings"
 	"syscall"
+	"time"
 
 	"github.com/jack-work/figaro/internal/config"
 	"github.com/jack-work/figaro/internal/gateway"
@@ -25,11 +27,46 @@ func defaultGatewaySocket() string {
 	return filepath.Join(angelusRuntimeDir(), "gateway.sock")
 }
 
-func runServe(loaded *config.Loaded, listen string, origins []string) error {
+// ServeOpts is what the verb collected from the command line.
+type ServeOpts struct {
+	Listen      string
+	Authn       string
+	DoorkeyFile string
+	Origins     []string
+	Hosts       []string
+	TLSDone     bool
+	MaxConnAge  time.Duration
+}
+
+func runServe(loaded *config.Loaded, o ServeOpts) error {
+	listen := o.Listen
 	if listen == "" {
 		listen = "unix://" + defaultGatewaySocket()
 	}
 
+	// An uncapped tunnel on a NETWORK bind is an unbounded authorization:
+	// forward_auth runs on the upgrade only, so the socket outlives the
+	// session that opened it. Eight hours is a working day, and a re-upgrade
+	// is a re-authorization. A unix socket needs no cap -- reaching it
+	// already required being the right uid.
+	if o.MaxConnAge == 0 && strings.HasPrefix(listen, "tcp://") {
+		o.MaxConnAge = 8 * time.Hour
+	}
+
+	// THE SECRET COMES FROM A FILE, never a flag. An argument is visible in
+	// /proc, in a shell history, and in the process table of every other
+	// user on the box; a file is a path plus a mode. It is also what
+	// systemd LoadCredential hands you, which is how this arrives in
+	// production.
+	var doorkey string
+	if o.DoorkeyFile != "" {
+		b, err := os.ReadFile(o.DoorkeyFile)
+		if err != nil {
+			return fmt.Errorf("doorkey file: %w", err)
+		}
+		doorkey = strings.TrimSpace(string(b))
+	}
+
 	// The gateway fronts a LOCAL angelus, so one must be running. We do not
 	// start it: ensureAngelus detaches a grandchild, which under systemd
 	// Type=exec escapes the unit's lifecycle and leaves an orphan the
@@ -47,7 +84,12 @@ func runServe(loaded *config.Loaded, listen string, origins []string) error {
 	srv, err := gateway.New(gateway.Config{
 		Listen:        listen,
 		AngelusSocket: sock,
-		Origins:       origins,
+		Authn:         gateway.Authn(o.Authn),
+		Doorkey:       doorkey,
+		Origins:       o.Origins,
+		Hosts:         o.Hosts,
+		TLSTerminated: o.TLSDone,
+		MaxConnAge:    o.MaxConnAge,
 	})
 	if err != nil {
 		return err
@@ -57,7 +99,7 @@ func runServe(loaded *config.Loaded, listen string, origins []string) error {
 	defer stop()
 
 	fmt.Fprintf(stderrw, "figaro gateway on %s -> %s\n", listen, sock)
-	if len(origins) == 0 {
+	if len(o.Origins) == 0 {
 		// Say it out loud. An empty allowlist is the SAFE default, but it is
 		// also the one that makes a browser client fail with a handshake
 		// error that says nothing useful, so the operator should hear about
 
@@ -0,0 +1,153 @@
+package gateway
+
+// THE REFUSAL TABLE.
+//
+// Every cell of (authenticator × bind reachability), decided once, here.
+// The rule this file exists to enforce: a combination that is an
+// authentication bypass must be UNREPRESENTABLE, not merely discouraged.
+//
+// Two lessons are baked in, both from adversarial review of the plan:
+//
+//  1. THE ADDRESS CANNOT BE JUDGED AS A STRING. ":9090", "0.0.0.0", "::",
+//     "[::1]", "::ffff:127.0.0.1", a hostname that resolves to a LAN
+//     address, and `localhost` repointed in /etc/hosts all defeat a config
+//     parse. So we BIND FIRST and interrogate the listener's resolved
+//     address, which is the only thing that cannot lie about itself.
+//
+//  2. LOOPBACK IS NOT A PRINCIPAL BOUNDARY. Any local uid reaches it, a
+//     container with host networking or a published port re-exposes it, and
+//     `ssh -L` tunnels it from anywhere. Loopback earns you "the reverse
+//     proxy can be the only route IF the box is not shared" and nothing
+//     more. Where that is not enough, the answer is a credential, not a
+//     tighter address check -- and the table says so.
+
+import (
+	"fmt"
+	"net"
+	"strings"
+)
+
+// Authn names an authenticator. A closed set: an unknown value is refused
+// rather than defaulted, for the same reason an unknown authz policy is.
+type Authn string
+
+const (
+	// AuthnNone trusts everyone who can reach the socket. Legitimate for a
+	// unix socket, where reaching it already required being the right uid.
+	AuthnNone Authn = "none"
+	// AuthnUpstream believes Remote-User / Remote-Groups, which only a
+	// reverse proxy should be able to set.
+	AuthnUpstream Authn = "upstream"
+	// AuthnDoorkey requires a shared bearer secret.
+	AuthnDoorkey Authn = "doorkey"
+)
+
+// KnownAuthn is the closed set, for validation and for error prose.
+var KnownAuthn = []Authn{AuthnNone, AuthnUpstream, AuthnDoorkey}
+
+// reach is how exposed a bound address turned out to be.
+type reach int
+
+const (
+	// reachUnix: a filesystem socket. The kernel's permission check is the
+	// gate, and it is a real one.
+	reachUnix reach = iota
+	// reachLoopback: bound to 127.0.0.0/8 or ::1. Reachable by every local
+	// uid, and by anything that can publish or tunnel the port.
+	reachLoopback
+	// reachOpen: bound to a routable or wildcard address. On a network.
+	reachOpen
+)
+
+func (r reach) String() string {
+	switch r {
+	case reachUnix:
+		return "a unix socket"
+	case reachLoopback:
+		return "loopback"
+	default:
+		return "a routable address"
+	}
+}
+
+// classify interrogates a BOUND listener. Nothing here parses a config
+// string, which is the whole point: net.Listener.Addr() reports what the
+// kernel actually did, including what a wildcard bind resolved to and which
+// family an ambiguous host landed in.
+func classify(ln net.Listener) reach {
+	addr := ln.Addr()
+	if addr.Network() == "unix" || addr.Network() == "unixpacket" {
+		return reachUnix
+	}
+	host, _, err := net.SplitHostPort(addr.String())
+	if err != nil {
+		// Cannot tell: assume the worst. An address we cannot parse is not
+		// an address we may call safe.
+		return reachOpen
+	}
+	ip := net.ParseIP(host)
+	if ip == nil {
+		return reachOpen
+	}
+	if ip.IsUnspecified() {
+		// 0.0.0.0 or ::. Bound to EVERY interface, including the routable
+		// ones. This is the case a naive "is it 127.0.0.1?" check misses.
+		return reachOpen
+	}
+	// IsLoopback handles ::1 and the v4-mapped ::ffff:127.0.0.1 correctly,
+	// which is why we ask the parsed IP rather than the string.
+	if ip.IsLoopback() {
+		return reachLoopback
+	}
+	return reachOpen
+}
+
+// admit is the table. It answers one question -- may this authenticator
+// serve on an address this exposed -- and it is the only place that answers
+// it.
+//
+// The shape to read off it: `none` needs the kernel; `upstream` needs to be
+// unreachable except through the proxy; `doorkey` carries its own proof and
+// so is the only cell that survives exposure, and even then only with TLS
+// terminated in front.
+func admit(a Authn, r reach) error {
+	switch a {
+	case AuthnNone:
+		if r == reachUnix {
+			return nil
+		}
+		return fmt.Errorf(
+			"authn=none on %s is an open door to a daemon that runs shell commands.\n"+
+				"Anyone who can reach the port is an administrator.\n"+
+				"Bind a unix socket, or choose an authenticator", r)
+
+	case AuthnUpstream:
+		switch r {
+		case reachUnix:
+			return nil
+		case reachLoopback:
+			// The house pattern: a reverse proxy on the same box strips
+			// inbound Remote-* and forward-auths. Sound only while nothing
+			// ELSE local is hostile -- see the doc comment on Config.
+			return nil
+		default:
+			return fmt.Errorf(
+				"authn=upstream trusts Remote-* headers, but %s is reachable off-host.\n"+
+					"Anyone who can reach it can claim any identity, including admin.\n"+
+					"Bind loopback or a unix socket and let the proxy reach you there", r)
+		}
+
+	case AuthnDoorkey:
+		// A bearer proves something on every request, so exposure is a
+		// transport-confidentiality question rather than an authentication
+		// one. Config.Check gates the plaintext case separately.
+		return nil
+
+	default:
+		names := make([]string, len(KnownAuthn))
+		for i, k := range KnownAuthn {
+			names[i] = string(k)
+		}
+		return fmt.Errorf("unknown authn %q: want one of %s", a, strings.Join(names, ", "))
+	}
+}