OpenRemote Gateway
Gateway mode moves remote access into one background desktop service so the app can stay connected while OpenCode instances come and go.
Work in progress. OpenRemote Gateway is currently supported only when building OpenRemote from source.
Setup
Initialize gateway config with the setup wizard from Installation. The wizard does not start the gateway or open the gateway TUI.
- Start the background gateway with
oo gateway start. - Open the gateway control UI with
oo gateway. - Start OpenCode normally in a workspace, for example
opencode -c --hostname 127.0.0.1. - The OpenRemote plugin registers that OpenCode instance with the gateway.
- Scan the QR code shown in the gateway TUI or OpenCode sidebar.
- The mobile app connects to the gateway and the gateway routes app traffic to the selected OpenCode instance.
Closing the gateway TUI does not stop the gateway. Use oo gateway stop to stop the background service.
After setup, oo is available as a short bin alias, for example oo gateway --help.
The bare setup wizard can initialize gateway config without starting the daemon or opening the gateway TUI.
The gateway saves its app-facing port after startup. Later start and restart commands try to reuse that port when it is available, and fall back to a free port when it is busy.
Purpose
The gateway is the stable local authority for OpenRemote. It owns remote access, app authentication, QR setup, resume credentials, tunnels, client limits, and routing to registered OpenCode instances.
The OpenCode plugin keeps working on its own when the gateway is unavailable. Gateway mode is an upgrade path for multiple OpenCode instances, Wake to Code, and a persistent gateway control UI.
Architecture
Mobile App
|
| one QR / one auth endpoint / OpenCode API
v
OpenRemote Gateway daemon
| | __ OpenCode instance: ~/workspace/openremote
|
__ OpenCode instance: ~/workspace/docs - The mobile app connects to the gateway, not directly to each OpenCode plugin.
- One gateway auth endpoint is shared by all registered OpenCode instances.
- The gateway TUI can show the active gateway QR, while the OpenCode sidebar can show a compact local QR before a client connects.
- Each OpenCode plugin registers its local OpenCode API target, workspace, active sessions, and heartbeat.
- The gateway forwards app API calls to the selected OpenCode instance.
- The selected instance is tracked per app client, with room for explicit instance headers later.
Commands
| Command | Behavior |
|---|---|
oo gateway | Open the gateway TUI attached to the background gateway. |
oo gateway start | Start the background gateway daemon and exit after it is ready. It tries the last saved app port before falling back to a free port. |
oo gateway stop | Stop the background daemon, local proxy, tunnel, and app-facing gateway service. |
oo gateway restart | Stop and start the daemon, reusing the last saved app port when available. |
oo gateway uninstall | Stop the daemon and remove gateway config/state so setup can run again as first-time setup. |
oo gateway status | Print a human-readable daemon status summary. |
oo gateway status --json | Print machine-readable gateway status for the OpenCode plugin and automation. |
oo gateway --help | Print gateway command usage. |
Plugin behavior
When OPENCODE_REMOTE_GATEWAY=auto, the plugin tries to use the gateway if it is configured and reachable. If the gateway is missing, unavailable, or not configured, the plugin falls back to the current sidebar QR/proxy behavior.
When the gateway is active, the plugin registers with it and keeps the OpenCode sidebar small: gateway health, remote access state, QR setup when needed, and connected-client status.
The sidebar hides QR setup once a gateway client is connected. Before connection, it prefers the compact local gateway URL for sidebar QR size, while the gateway TUI can show the active gateway URL.
Workspaces
The gateway can reopen previously connected workspaces for Wake to Code. A workspace becomes known only after a local OpenCode plugin successfully registers it.
- The app can request only a known workspace id. It cannot send arbitrary commands or paths.
- The gateway uses the last command used to open that workspace.
- If the workspace is already open, the gateway switches to that instance instead of starting another copy.
- The gateway TUI shows registered instances and recent workspaces for desktop visibility.
Configuration
| Variable | Default | Description |
|---|---|---|
OPENCODE_REMOTE_GATEWAY | auto | auto tries gateway then falls back to current plugin behavior. required requires gateway. off disables gateway mode. |
OPENCODE_REMOTE_SECRET | generated | Use a static gateway secret. When set, automatic secret rotation is disabled. |
OPENCODE_REMOTE_SECRET_ROTATION_SECONDS | 30 | Rotate the generated gateway secret after this many seconds while no client is connected. Use 0 to generate once on start and never rotate. |
OPENCODE_REMOTE_MAX_CLIENTS | 1 | Maximum connected remote clients. Use 0 for unlimited clients. |
OPENCODE_REMOTE_REQUIRE_CLIENT | true | Require the app's x-openremote-client header for gateway remote access. |
OPENCODE_REMOTE_RESUME | true | Allow the same app client to reconnect with its previous gateway password after heartbeat loss or explicit disconnect, even if a new invite password has rotated. |
OPENCODE_REMOTE_RESUME_SECONDS | 28800 | Reconnect grace window, in seconds, for saved resume credentials. |
OPENCODE_REMOTE_MAX_CLIENT_ID | true | Use the app client id when enforcing OPENCODE_REMOTE_MAX_CLIENTS. |
OPENCODE_REMOTE_MAX_CLIENT_IP | false | Include client IP in gateway max-client keys. |
OPENCODE_REMOTE_MAX_CLIENT_USER_AGENT | false | Include user agent in gateway max-client keys. |
The saved gateway config also stores the last successful app port so stop/start and restart can keep QR URLs stable when the port is still free.