Private Provider on Nostr: What you actually built (the ticket booth) Strip away the FIPS and Cashu specifics ...

What you actually built (the ticket booth)

Strip away the FIPS and Cashu specifics and your MVP is four machines bolted together:

1. A ticket seller — takes a Cashu token, checks it's real and unspent at the mint, converts sats into minutes.
2. A wristband printer — writes down "npub X is allowed until 10:30" (the session store + the ACL entry with its expiry marker).
3. A turnstile — the FIPS ACL and firewall that physically enforce "is this npub allowed through, yes or no."
4. A janitor — the reconcile sweep that walks around removing expired wristbands, even if everyone went home.

Notice something: none of these four machines know or care what's behind the turnstile. They handle payment, identity, time, and enforcement. The thing being
sold is just... whatever the operator decided to put back there.

The small pond vs. the big ocean

Right now, what's behind the turnstile is services on your private mesh — an SSH box, a file share, a web service. Who pays for that? Mostly hobbyists and
your friends. It's a small pond, and it's stocked with fish you put there yourself.

The original TollGate idea aims at a much bigger ocean: selling internet access itself. Someone with no connectivity — a traveler, someone whose data plan ran
out, someone on censored or broken infrastructure — pays a few sats and gets online through your connection. That's a proven, universal demand; people already
pay for hotspot Wi-Fi, mobile data, and VPNs every day. The commodity is valuable everywhere on Earth, unlike "access to my mesh."

Why you're not locked in

Here's the key point: switching from the pond to the ocean is a venue change, not a rebuild. Your turnstile today says "this npub may peer with my mesh and
reach port 22." The internet version says "this npub's traffic may exit to the internet through me." Same ticket seller, same wristbands, same turnstile
mechanism, same janitor — only the rule written on the gate changes. That collection of machinery is called the control plane, and you built it once,
correctly, in a way that doesn't depend on the product being sold. That's what I meant by "it transfers."

Mesh-only was a safety cage, not a wall — you deliberately scoped down (test funds, no abuse exposure) while proving the machinery. Smart. But nothing in the
code welded the cage shut.

The identity head-start

This part is easy to underrate. Traditional paid Wi-Fi gateways have a miserable identity problem: they recognize customers by MAC address (easily spoofed,
and modern phones randomize it constantly) or by captive-portal accounts (emails, passwords, a database to hack). You skipped all of that. Your customer
identity is a nostr keypair from day one — unforgeable, portable, no accounts, no personal data, and the mesh handles addressing so there's no IP-management
bookkeeping either. Anyone rebuilding TollGate on plain Wi-Fi has to duct-tape exactly the layer you got for free. That's the genuinely novel contribution
hiding inside your MVP.

What does not transfer for free

Honesty time — the ocean has sharks the pond doesn't:

- Byte metering. On your mesh, an hour of access costs you nothing per packet. On an internet exit, a customer who paid for an hour can burn gigabytes — your
money. You'd need per-peer traffic accounting, which your own docs already list as future work.
- Abuse and legal exposure. Whatever customers do comes from your IP address. This is exactly why mesh-only was the right MVP scope, and crossing this line
needs a real review, not just a config change.
- Customer experience. Discovery (how does a stranger find your offer?) needs the Nostr advertisement/discovery transport — the advertise command on the
roadmap is the first small step.

In one sentence: you set out to sell fish from a small private pond, but along the way you built a tollbooth that works on any road — and the pond was just
the safest place to test the tollbooth. 🐡