Your machines take orders from you, not from Console. With signed commands on, every change is signed in a browser you trust, and the machine checks the signature before it acts. Even a breach of Console's database can't restart, stop or power off anything.
Nothing on a machine running cntrl listens for Console.
The agent opens one TLS connection out, the way a browser opens a website. There's no port to forward and no VPN, and it works the same behind CGNAT.
Your router stays closed.
One winter night I left my PC running because I was too lazy to walk over and put it to sleep.
That became Cntrl Bridge. Today I'm launching what came next, Cntrl Console. One command per machine, and every server you run is on your phone, with no port open.
