Printer connections
Gantry talks to printers directly on your local network, in the maker’s protocol. There is no relay server.
- Bambu Lab: MQTT over TLS. The printer certificate is pinned on first connection (trust on first use), and an unexpected certificate change later blocks the connection.
- Klipper, PrusaLink and other HTTP APIs: when the printer or server uses HTTPS, Gantry validates the certificate and never relaxes that check. A certificate error does not silently switch to another address.
- Network interface: a connection can be pinned to a specific interface, and Gantry blocks addresses that could bypass that pin.
Access codes, API keys and tokens
- macOS: Keychain.
- Windows: DPAPI, encryption tied to the user account.
- Linux: Secret Service (such as GNOME Keyring). Without a compatible keyring Gantry refuses to store secrets in plain text, and the settings file is readable by the owner only.
- Integration tokens (such as Bearer tokens for Spoolman and webhooks) go to the same store, not to plain settings.
Remote access and API
- The local preview server works only on your network and is read-only.
- The bridge to your own hosting signs every upload with HMAC-SHA256 using the bridge key. The server computes the signature over the exact bytes it received and rejects anything Gantry did not sign, so nobody in between can add a printer or change a temperature.
- The web panel on your hosting runs over HTTPS. The site password is stored as a hash, and the bridge key stays in PHP, never in JavaScript. Sessions use an HttpOnly, SameSite cookie, forms are CSRF-protected and sign-in attempts are rate-limited.
- Control is optional: View only mode accepts no commands, and even with control on, commands are carried out by the app on your computer, within what the printer allows.
- Telegram talks to the Bot API directly through your own bot and answers only in the configured chat.
Gantry Cloud: end-to-end encryption
Printer data is encrypted on your computer before it leaves your network. The server only stores and forwards ciphertext.
- AES-256-GCM for printer status, camera pictures, farm and statistics. Only your browser decrypts it.
- A two-part key: only the sign-in part reaches the server, stored as a hash. The encryption part stays in the app and your browsers.
- Commands (such as pause) are encrypted by the browser and decrypted only by the app.
- The key vault can be protected with a separate password: PBKDF2-HMAC-SHA256, 600,000 iterations and a random salt. The password and recovery code are never sent to the server.
- Accounts: HTTPS only with HSTS, Argon2id password hashes, a strict Content Security Policy, and the admin panel requires a second factor (TOTP).
- Shop and invoicing integrations keep API credentials encrypted with a server key (AES-256-GCM). This differs from printer data, because the server has to talk to those services on your behalf.
Details: How Gantry Cloud encrypts.
Updates and open source
- Gantry is open source under the MIT licence, so you can check every safeguard on this page on GitHub.
- Update packages are verified with code signing on macOS and a SHA-256 checksum on Windows.
- Every release comes with published file checksums.
Honest limits
- Certificate pinning protects later connections, but the first connection to a printer must happen on a trusted network.
- The Gantry Cloud dashboard is loaded from the server. Someone who took over the server and replaced the page could try to capture the key in the browser. The desktop app does not have this risk.
- The Cloud server sees metadata: when and how much data your computer sends.
- The macOS app is not yet notarised by Apple, and the Windows packages have no commercial publisher signature.
Report a security issue
If you find a vulnerability, please do not post it in a public issue. Use GitHub’s private vulnerability reporting or write to info@gantry3d.pl. Leave out access codes, serial numbers and IP addresses.