Bohdan Triapitsyn
7ea974d89b
- new Connect a Device page: one-time QR pairing, transport choices, device management - new Private Relay page: E2EE guarantees, demand-driven lifecycle, relay vs tunnel - rewrite mobile page around the native iOS/Android apps (TestFlight + APK) - update remote-instances, security, tunnels, and remote-access troubleshooting to point at the new pairing flow - translate everything across all 8 locales and update the sidebar
45 lines
2.4 KiB
Plaintext
45 lines
2.4 KiB
Plaintext
---
|
|
title: Security
|
|
description: Protect the UI with a password and passkeys before exposing it.
|
|
---
|
|
|
|
# Security
|
|
|
|
OpenChamber gives access to your machine and your code, so lock it down before anyone but you can reach it. This page covers the UI password, passkeys, and what to know before exposing OpenChamber to a network.
|
|
|
|
## Set a UI password
|
|
|
|
Start OpenChamber with a password and the browser UI asks for it:
|
|
|
|
```bash
|
|
openchamber --ui-password be-creative-here
|
|
```
|
|
|
|
You can also set it with the `OPENCHAMBER_UI_PASSWORD` environment variable instead of putting it on the command line. After signing in, OpenChamber remembers the device for a while so you're not asked every time.
|
|
|
|
Always set a password if the instance is reachable by anyone else — especially over a [tunnel](/tunnels/) or the public internet.
|
|
|
|
## Passkeys
|
|
|
|
Once a password is set, you can add passkeys (Face ID, Touch ID, a security key) for quicker sign-in. Add them at **Settings → OpenChamber → Passkeys**.
|
|
|
|
Passkeys are tied to the current password. If you change or remove the password, saved passkeys are cleared and you'll add them again.
|
|
|
|
## Device tokens
|
|
|
|
Devices paired through [Connect a Device](/connect-devices/) authenticate with their own per-device tokens, not the UI password. Pairing links are single-use and expire if unused; every paired device is listed at **Settings → Remote Instances → Connect to this server**, where you can revoke any of them at any time. Away-from-home connections go through the [Private Relay](/private-relay/), which is end-to-end encrypted and cannot read your traffic.
|
|
|
|
## Before you expose it
|
|
|
|
- By default OpenChamber only listens on your own machine (`127.0.0.1`). It takes a deliberate change to listen more widely, and you should set a password first.
|
|
- For your own devices, prefer [pairing](/connect-devices/) with the [Private Relay](/private-relay/) — nothing is exposed publicly at all.
|
|
- If you need a public URL, prefer a [tunnel](/tunnels/) or a private network (like a VPN) over opening a port to the internet.
|
|
- If you put OpenChamber behind your own HTTPS server, see [Reverse Proxy](/reverse-proxy/).
|
|
|
|
## Related
|
|
|
|
- [Connect a Device](/connect-devices/) — one-time pairing and per-device tokens
|
|
- [Private Relay](/private-relay/) — end-to-end encrypted access from anywhere
|
|
- [Tunnels](/tunnels/) — expose a public URL when you need one
|
|
- [Reverse Proxy](/reverse-proxy/) — run OpenChamber behind your own server
|