Remote access
How a machine becomes reachable from anywhere, on infrastructure you own, in one command.
The daemon never listens on the network
It binds loopback and nothing else. Reaching a machine from elsewhere is one opt-in command, and what that command deploys belongs to you.
There is no hosted service to sign into and no port to forward. Instead, both ends dial out to a small Worker running in your own Cloudflare account, and the Worker bridges them.
The protocol in one picture
daemon
on your machine · dials out, never listens
wss /daemon/<id>
Worker, one Durable Object per machine
in your Cloudflare account · forwards frames, holds no key
wss /client/<id>
browser
any device you paired · pins the daemon key
Noise IK, end to end: browser initiator, daemon responder
frame: [4B channel][payload] · inside: [1B kind][wire protocol bytes]
The Worker is inside the encrypted run rather than at the end of it. It moves opaque frames between two sockets; the Noise channel is between your browser and your daemon, with the daemon's key pinned when the browser paired.
Setting it up
Run this once, on one machine. It verifies the token, deploys the Worker and the web app, and joins this machine to it.
$ flue relay setup token verified worker deployed: flue-relay web app uploaded reachable at https://flue-relay.you.workers.dev this machine joined as laptop (laptop-9f3a)
Every other machine runs the flue relay join line that setup prints. No token, nothing to deploy, and one relay fronts every machine you own. Each browser pairs once, from the QR code the machine shows.
The API token stays on the machine that used it
It is written to one file only you can read, kept so that updating the relay never asks for it again, and deleted whenever you want it forgotten.
What it costs
A Worker and one Durable Object per machine. Cloudflare's free plan is enough for personal use. The caps, the counters and how to read them are in the operator runbook.
What the relay can and cannot see
Cannot see: The contents of any session. Keystrokes, output and scrollback are Noise ciphertext it holds no key for.
Cannot see: Your daemon's private key, or any device's.
Can see: Who connected, when, and how much traffic moved each way. Enough for traffic analysis, never content.
Can see: The pairing exchange, which crosses a cleartext control channel carrying a single-use token that lives two minutes.
There is one more thing worth knowing, and it is not about the cryptography: the web app is served by the relay origin, so you are trusting that origin to serve the published code. The FAQ says exactly what that means, because it is the honest limit of every end-to-end encrypted web app.
Prefer the direct path when you have one
Pairing through a relay is a trust decision about that relay. Pair over the daemon's own origin when the browser can already reach the machine directly, on the same LAN or across a private network like Tailscale. A phone that is off the network has no such path, and there the relay is the only way to pair at all.