# mindmount

Unified router on **:3000**. Single authentication source for the network:

- `/ips/*` → gapmind (`GAPMIND_URL`, default `http://127.0.0.1:3002`)
- `/socials/*` → socmind (`SOCMIND_URL`, default `http://127.0.0.1:3001`)

Examples:

```sh
curl localhost:3000/ips/api/resolve?ip=8.8.8.8
curl localhost:3000/socials/api/social/search?username=nasa
curl localhost:3000/ips/api/docs        # gapmind Swagger (proxied)
curl localhost:3000/socials/api/docs    # socmind Swagger (proxied)
```

## Auth

| Env | Purpose |
|---|---|
| `MOUNT_API_TOKEN` | Client-facing token. If set, every proxied request needs `Authorization: Bearer <token>`. If unset, open. |
| `GAPMIND_TOKEN` | Shared/configured gapmind service token. Wins over auto-signup. |
| `GAPMIND_EMAIL` / `GAPMIND_PASSWORD` | Auto-signup identity (`mindmount@local` default). On boot, mindmount `POST`s gapmind `/api/accounts/signup` and stores the token. |

Per request: a caller-supplied `Authorization` header is forwarded as-is;
otherwise the provisioned gapmind token is injected on `/ips/*` routes.