care-pi DNS service

This service gives each care-pi device a name in the form <id>.care-pi.rithviknishad.dev. The name points to the address of the device on the clinic network (LAN). With this name, the device gets a public certificate from Let's Encrypt. Then the browsers on the clinic network open Care with no certificate warning, and you do not install a certificate on each device.

Find the clinics on your network

This list shows the clinics that registered from your public IP address and that agreed to be on the list. A clinic is not on the list if it did not agree. This is the default.

Make sure that the address is your clinic

The console of your care-pi device shows its id. Compare that id with the address in the address bar of your browser. If the two are not the same, stop. Do not type a password. Another device on your network can show a page that looks like Care.

Install a certificate from a QR code

If your care-pi device uses its own certificate authority (offline mode), the console shows a QR code. Scan the QR code with the new phone or tablet. The code opens /cert, which shows the fingerprint of the certificate and lets you download it. The certificate is in the part of the link after #. Your browser does not send that part to this service.

What this service keeps

The id of each clinic and the hostname that the device sent.
The public key of the device and a hash of its ACME password.
The LAN address (IPv4, IPv6) of the device. This address is in public DNS.
The public IP address of the network at registration and at the last update, and the times of these events.

The service does not receive patient data. Care traffic goes directly from the browser to the device on the clinic network. It never goes through this service.