Skip to main content

Remote Access

Choose the right method to expose CodePiper securely over the network.

Overview

By default, the CodePiper dashboard binds to 127.0.0.1:3000 and the WebSocket server to port 9999. For remote access, you need to expose both ports securely.

Choose the approach that fits your situation:

MethodBest forTLSPersistent URLAuth layer
SSH TunnelQuick access, no setupEncryptedNoSSH key
TailscalePrivate mesh, zero configWireGuardMagicDNSTailnet ACL
ngrokQuick demo, sharingAutomaticPaid onlyPaid only
Cloudflare TunnelProduction, freeAutomaticYesNone (add Access)
Cloudflare Zero TrustProduction, recommendedAutomaticYesIdentity-aware
NginxSelf-hosted, full controlLet’s EncryptYesNone (add your own)
CaddySelf-hosted, automatic TLSAutomaticYesNone (add your own)

Daemon Environment

When using any tunnel or reverse proxy, set these environment variables:

Terminal window
TRUST_PROXY_HEADERS=true \
FORCE_SECURE_COOKIES=true \
ALLOWED_ORIGINS=https://codepiper.yourdomain.com \
codepiper daemon --web
  • TRUST_PROXY_HEADERS: Read X-Forwarded-* headers for client IP and protocol detection
  • FORCE_SECURE_COOKIES: Set Secure flag on session cookies (required for HTTPS)
  • ALLOWED_ORIGINS: Restrict WebSocket and CSRF origin checks to your domain

Note: SSH Tunnel and Tailscale (direct IP mode) don’t need these variables since they forward raw TCP without modifying headers.

Security Considerations

When exposing CodePiper to the internet:

  • Always use TLS. Never expose the HTTP port directly. The dashboard transmits session cookies and terminal data.
  • Set ALLOWED_ORIGINS. This prevents cross-site WebSocket hijacking.
  • Use strong passwords and MFA. Both are enforced by default, but choosing a long password matters more when the login page is internet-facing.
  • Consider IP restrictions. Use firewall rules, Nginx allow/deny directives, or Cloudflare Access policies to limit access.
  • Review the audit log. Check codepiper audit regularly for unexpected activity.
  • Prefer Cloudflare Zero Trust or Tailscale for internet-facing deployments. Both add a second authentication layer before traffic reaches your origin.

What’s next