Remote access

Full guide: Remote access (matches Settings → Remote access in the gateway console).

Use these patterns when the gateway runs on another machine (VPS, home server, sleeping laptop host).

SSH tunnel (universal fallback)

Forward the remote gateway loopback port to your laptop:

ssh -N -L 18790:127.0.0.1:18790 user@gateway-host
# or
xopc gateway ssh-tunnel --target user@gateway-host

Then open http://127.0.0.1:18790 locally.

Persistent CLI remote target

{
  gateway: {
    mode: "remote",
    remote: {
      url: "http://127.0.0.1:18790",
      token: "your-token",
      transport: "ssh",
      sshTarget: "user@gateway-host",
    },
  },
}

CLI/TUI/MCP read gateway.remote when gateway.mode=remote. Override with XOPC_GATEWAY_URL.

Tailnet (recommended)

Keep gateway.bind=loopback and enable Tailscale Serve.

Public internet (advanced)

Use the managed FRP tunnel with consent — not for everyday use.

Decision tree

1. Same Tailnet? → Tailscale Serve
2. SSH to host? → SSH tunnel + gateway.mode=remote
3. Need public URL / mobile QR? → FRP tunnel
4. Enterprise front door? → trusted-proxy + Caddy/nginx

See also network.md.