Get

Remote access

AirCode Ø is built to be driven from anywhere while the application, projects, terminals and agents keep running on your own machine. Never expose it unauthenticated to the public internet.

Built-in Remote Access

The desktop app and server include an outbound-only tunnel. You do not need to open a router port or configure dynamic DNS:

  1. Open Remote access from the broadcast icon in the activity bar.
  2. Open Settings and select AirCode Ø relay.
  3. Return to Remote access and enable the tunnel.
  4. Open the generated HTTPS URL, or scan the QR code to add it on your phone.

Your AirCode Ø password still protects the server, and the application, projects and sessions remain on the host machine. The tunnel refuses to start if no password is configured.

Managed-relay trust boundary

The current managed relay terminates TLS before forwarding authenticated traffic to your AirCode Ø host. Relay operators can therefore technically access traffic while it passes through the relay, even though application and session data are not stored there as part of the normal service. End-to-end encryption that prevents relay inspection is not yet available.

Use Private network only with Tailscale or another VPN, or operate a custom relay, when that trust boundary does not meet your requirements.

Fast preview and Shared browser

The Browser screen offers two different transports:

  • Fast preview is the default for a localhost development URL. The page, assets, live reload and HMR WebSockets render directly on the viewing device; Chromium does not run on the server. With Remote Access enabled, AirCode Ø creates a revocable preview origin through the relay. Opening it once exchanges the access link for an HttpOnly cookie. You can add a per-preview password as a second layer; the private link is still required, the password is stored only as a local hash, and failed attempts are rate-limited.
  • Shared browser runs Chromium on the server and streams the same interactive session to people and agents. Choose it when an agent needs browser control, diagnostics, screenshots or traces.

Closing a Fast preview revokes its relay origin. Preview links are access capabilities even when a password is enabled: do not publish them.

Tailscale or your own VPN

For peer-to-peer access without the AirCode Ø relay, open Remote access → Settings and select Private network only. AirCode Ø then opens no public tunnel.

Install Tailscale on the server and your devices. AirCode Ø detects and binds the tailnet IP automatically; open http://<tailnet-ip>:7860 from another device. tailscale serve can add HTTPS with a real certificate:

sudo tailscale serve --bg "http://$(tailscale ip -4):7860"

The first run may print an admin-console link to enable Serve/HTTPS on your tailnet (a one-time, one-click switch).

WireGuard, ZeroTier or an SSH tunnel (ssh -L 7860:localhost:7860 server) work the same way.

Custom relay

Organizations can run the compatible Caddy + FRP relay from the AirCode Ø source tree. Select Custom relay in Remote access settings and enter its HTTPS origin, for example https://relay.example.com.

The desktop and mobile apps

Add a connection with the server URL + password. Connections are stored in the OS keychain. The desktop app shows the active server in the bottom-left status indicator — click it to switch or add servers (local or remote).

Firewalls

The built-in tunnel requires no inbound port. It makes outbound connections to the relay over HTTPS and FRP. Private-network mode opens no additional connection; your VPN determines reachability. Fast previews use authenticated ephemeral ports on the same interface as the AirCode Ø server, so a restrictive host firewall must allow traffic from the private network to those ports.

For a Docker sandbox session, this route still ends at the host AirCode Ø control plane. Terminal traffic then crosses the Docker API to the worker. The tunnel does not automatically carry worker egress and does not publish development ports from the container.