Publishing garage telemetry to the internet invites scanning. Lock down who can read feeds, rate-limit public endpoints, and never expose the Arduino JSON port directly without understanding the risk.
Hardening checklist
- HTTPS only on public URLs; HSTS at the reverse proxy.
- Optional API keys or signed tokens for non-browser clients.
- Firewall the Arduino to LAN-only; only the relay reaches it.
- No secrets in firmware source committed to public repos.
Dashboard integration
Users paste HTTPS feed URLs in temperature feed settings. The site stores URLs per account—pair with Supabase auth so feeds are not world-editable.
Compare stacks
Node and Next patterns for APIs: Node Express API patterns. This project uses Astro fetch routes—Astro SSR.