Remote access and security

The relay listens on the machine it runs on. To use it from a phone on the road, something has to carry the connection there. These pages cover how you sign in, the ways to make the relay reachable, and what that exposes.

• Access and sign-inHow the relay decides who gets in — the access token, the sign-in cookie, rotating the token, this machine only versus LAN, and what is open without a token.
• SSH tunnelLet the relay open a reverse SSH tunnel to a server you control, so you can reach it from anywhere without opening a port at home.
• Cloudflare TunnelGive the relay a public HTTPS address without a server of your own: the relay runs Cloudflare's cloudflared for you. Set-up, behavior and troubleshooting.
• Reverse proxyPut Caddy, nginx or a tunnel's edge in front of the OAR relay - what the proxy must pass, the config keys for a proxy on another host (trustProxy, allowedOrigins, localhostOnly), and which endpoints answer only the relay's own machine.
• Security overviewOne page for the owner who puts a relay on the internet - the trust model, what is public, what a signed-in browser reaches, where secrets live, what leaves the machine.