Remote access

Choose a method

• Start with the same network. It needs no setup and is the fastest.
• To use Mob from anywhere, choose Tailscale Serve if you're happy to run the Tailscale app on your phone: only your devices can reach mobd. Otherwise choose Cloudflare Tunnel.
• Funnel is for occasional use without a domain; it's slower than the others.

Whatever you choose, every device must pair: an address alone gives nobody access to mobd.

Same network (LAN)

For devices on the office Wi-Fi. On the office computer:

mobd link

Without remote access set up, it prints the office computer's network address with a QR code: http://<name>.local:8080 on a Mac, the computer's network IP on Linux, such as http://192.168.1.20:8080. Scan it in Mob (Settings → Machines → Add machine). Once remote access is set up, mobd link uses that address instead; mobd link --lan always gives the network one.

• mobd must listen on the network. mobd init sets "listen": "0.0.0.0:8080". If yours is 127.0.0.1:8080, mobd link says so instead of printing a code that cannot work.
• It is plain HTTP. Use it on a network you trust, never forward port 8080 to the internet.
• Firewall: on macOS, if the firewall asks, allow mobd to accept incoming connections. On Linux, open port 8080 and UDP 9527 to your network (how).

Tailscale Serve

Your devices join a private network (a tailnet) with the office computer. mobd gets an HTTPS address that only they can reach, and the live view keeps WebRTC.

What you need

• Tailscale on the office computer and on each device, signed in to the same account. On Linux: curl -fsSL https://tailscale.com/install.sh | sh, then sudo tailscale up.
• In the admin console → DNS: MagicDNS and HTTPS Certificates turned on.

Set it up

mobd remote setup --tailscale

It checks Tailscale is installed and signed in and that HTTPS is on, shows the tailscale serve command and asks before running it, then checks the new address reaches this mobd and saves it. Then pair each device with Tailscale switched on:

mobd link

sudo tailscale serve --bg --https=443 http://127.0.0.1:8080
tailscale serve status

Check it is direct

tailscale ping your-phone

via direct or via an address and port means the device talks to the office computer directly. via DERP(…) means it goes through a Tailscale relay: it works, but requests can take seconds when the relay is far away. Give it a minute, or try another network.

Turn it off

mobd remote off, or by hand sudo tailscale serve --https=443 off. Paired devices stay paired.

Cloudflare Tunnel

Your devices reach mobd at an HTTPS address on your own domain, with no app besides Mob. The office computer runs cloudflared, which connects out to Cloudflare, so it needs no public IP or open port. The tunnel carries no UDP, so the live view uses the WebSocket stream.

What you need

• A Cloudflare account and a domain whose DNS is on Cloudflare; below, mob.example.com.
• In the Cloudflare dashboard, Zero Trust → Networks → Tunnels: create a Cloudflared tunnel, environment macOS or Debian, and copy the token from the install command it shows.
• On the tunnel, add a public hostname: mob.example.com, service type HTTP, URL 127.0.0.1:8080. HTTP, not HTTPS: Cloudflare provides the certificate.

Set it up

mobd remote setup --cloudflare --hostname mob.example.com

It asks for the token without showing it, installs cloudflared if needed (Homebrew on macOS, Cloudflare's apt repository on Debian and Ubuntu), installs it as a service that starts at boot (asking before each command), waits for the tunnel, checks https://mob.example.com reaches this mobd and saves it. Then pair each device:

mobd link

sudo cloudflared service install YOUR_TUNNEL_TOKEN
mobd link --url https://mob.example.com

If devices only use the tunnel, set listen to 127.0.0.1:8080 and run mobd restart, so the unencrypted port isn't open on your network. Keep the tunnel token secret; regenerate it in the dashboard if it leaks.

Turn it off

mobd remote off removes the service from the office computer (by hand: sudo cloudflared service uninstall). The tunnel and hostname stay in your Cloudflare account until you delete them there. Paired devices stay paired.

Tailscale Funnel

A public HTTPS address from Tailscale for devices without the Tailscale app, with no domain needed. Traffic always goes through Tailscale's relays, so requests can take seconds when they are far away. mobd remote doesn't set it up; by hand:

sudo tailscale funnel --bg --https=443 http://127.0.0.1:8080
sudo tailscale funnel status
mobd link --url https://office.your-tailnet.ts.net

Serve and Funnel cannot share a port. To move to Serve once your devices have Tailscale, run sudo tailscale funnel --https=443 off, then the Serve setup; the address stays the same, so devices stay paired. See Tailscale Funnel.

At the office and away

An office computer can have more than one address: the fast network address at the office and a remote one for elsewhere. Scan a code for each:

mobd link --lan   # scan: the office network address
mobd link         # scan: the remote address

The second code for the same computer adds its address to its row in Settings → Machines, labelled LAN or Remote; there is still one row, with the same conversations. The row shows which route is in use and whether it answers. To switch, long-press the computer in the list (on the desktop app, click the route next to its name), or tap the route under the chat title. When the route in use doesn't answer, Mob shows LAN not reachable · Use Remote; it never switches by itself. Each address is paired on its own, so the device credential only goes to addresses it was paired on.

With Tailscale or Cloudflare the remote address also works at the office, so one address is often enough. The LAN address mainly makes the live view faster at your desk.

Security

• Every request needs a paired device. Without its credential, mobd answers nothing but the pairing request, whatever the route.
• Pairing is closed unless you open it. mobd link creates one invitation: 256-bit, one use, valid for 10 minutes, and only on the office computer. With no open invitation, mobd refuses every pairing attempt and logs it. Run mobd link --close once your device is added.
• A public address (Cloudflare Tunnel, Funnel) is reachable by anyone but useless without pairing. Keep mobd up to date. For Cloudflare, you can add a rate-limiting rule for /pair under Security → WAF.
• Who can read the traffic: on the office network it is plain HTTP. Tailscale encrypts end to end. Cloudflare ends TLS on its servers, so invitations, credentials, conversations and the live view pass through it decrypted; if that isn't acceptable, use Tailscale Serve.
• A lost device: mobd clients list, then mobd clients revoke CLIENT_ID. It is cut off on every route at once.
• Don't put Cloudflare Access in front of mobd for now: Mob can't sign in to it yet.

Problems

Start with this on the office computer. It shows the remote address and checks it reaches this mobd:

mobd remote

Still stuck? See FAQ & help, or report a problem.