PatchNodeSetup guides and support
The full guides, with copyable commands and troubleshooting, are built into the app: Settings › Help and support › Guides.
In summary
User and API token, role PVEAuditor on / for the user and the token (Privilege Separation = intersection), PatchNodePower role (VM.PowerMgmt) for actions, always together with PVEAuditor on paths below / (a deeper ACL replaces the inherited roles, so guests would vanish), reverse proxy with the https scheme.
Token user@realm!tokenid:secret (colon), role Audit on /.
Portainer access token, or tecnativa/docker-socket-proxy without a published port, on the reverse proxy's Docker network, POST=0, behind an Access List with a password (Satisfy All). Never expose docker.sock.
No token: LAN/VPN only, optional Basic authentication through the reverse proxy.
Service account with the Viewer role and a token.
Create a status page and use its URL ending with /status/<slug>.
Settings › Trust credentials › OAuth client with Devices › Core › Read; not the API keys.
cscli bouncers add patchnode; the Local API listens on 127.0.0.1 by default.
Dedicated user with View Only on Proxy Hosts.
Dedicated user in AdGuardHome.yaml (no read-only role: LAN/VPN only).
Long-lived token of a non-admin user; Glances in web server mode.
Frequently asked questions
It works at home but not outside.
PatchNode talks directly to your servers. Outside, your iPhone needs a VPN such as Tailscale or WireGuard, and your names must resolve through it (split DNS).
Why is HTTPS required?
Your tokens travel with every request. Put your services behind a reverse proxy with a valid certificate (for example Let's Encrypt with a DNS challenge).
A service says “paused”.
After a refused token or a reverse proxy block, PatchNode stops asking so it never gets your IP banned by CrowdSec or fail2ban. Allow-list your LAN and VPN in your IPS.
I lost my iPhone, or a token may have leaked.
Revoke the tokens on each server, then create new ones. PatchNode is locked by Face ID or your passcode, but a revoked token is the only certain protection. Prefer read-only tokens.
Do you receive any data?
No. There is no account, analytics, or server of ours. PatchNode connects only to the servers you configure. Nothing is shared with us unless you choose to share it.
Can I try without a server?
Yes: Settings › Demo shows a complete sample HomeLab generated on the iPhone.
Contact
For support, read the in-app guides, write to patchbay-s@proton.me or open a GitHub issue.