OpenRemote Gateway

Gateway mode moves remote access into one background desktop service so the app can stay connected while OpenCode instances come and go.

Work in progress. OpenRemote Gateway is currently supported only when building OpenRemote from source.

Setup

Initialize gateway config with the setup wizard from Installation. The wizard does not start the gateway or open the gateway TUI.

  1. Start the background gateway with oo gateway start.
  2. Open the gateway control UI with oo gateway.
  3. Start OpenCode normally in a workspace, for example opencode -c --hostname 127.0.0.1.
  4. The OpenRemote plugin registers that OpenCode instance with the gateway.
  5. Scan the QR code shown in the gateway TUI or OpenCode sidebar.
  6. The mobile app connects to the gateway and the gateway routes app traffic to the selected OpenCode instance.

Closing the gateway TUI does not stop the gateway. Use oo gateway stop to stop the background service.

After setup, oo is available as a short bin alias, for example oo gateway --help.

The bare setup wizard can initialize gateway config without starting the daemon or opening the gateway TUI.

The gateway saves its app-facing port after startup. Later start and restart commands try to reuse that port when it is available, and fall back to a free port when it is busy.

Purpose

The gateway is the stable local authority for OpenRemote. It owns remote access, app authentication, QR setup, resume credentials, tunnels, client limits, and routing to registered OpenCode instances.

The OpenCode plugin keeps working on its own when the gateway is unavailable. Gateway mode is an upgrade path for multiple OpenCode instances, Wake to Code, and a persistent gateway control UI.

Architecture

Mobile App
    |
    | one QR / one auth endpoint / OpenCode API
    v
OpenRemote Gateway daemon
    |    | __ OpenCode instance: ~/workspace/openremote
    |
     __ OpenCode instance: ~/workspace/docs
  • The mobile app connects to the gateway, not directly to each OpenCode plugin.
  • One gateway auth endpoint is shared by all registered OpenCode instances.
  • The gateway TUI can show the active gateway QR, while the OpenCode sidebar can show a compact local QR before a client connects.
  • Each OpenCode plugin registers its local OpenCode API target, workspace, active sessions, and heartbeat.
  • The gateway forwards app API calls to the selected OpenCode instance.
  • The selected instance is tracked per app client, with room for explicit instance headers later.

Commands

Command Behavior
oo gateway Open the gateway TUI attached to the background gateway.
oo gateway start Start the background gateway daemon and exit after it is ready. It tries the last saved app port before falling back to a free port.
oo gateway stop Stop the background daemon, local proxy, tunnel, and app-facing gateway service.
oo gateway restart Stop and start the daemon, reusing the last saved app port when available.
oo gateway uninstall Stop the daemon and remove gateway config/state so setup can run again as first-time setup.
oo gateway status Print a human-readable daemon status summary.
oo gateway status --json Print machine-readable gateway status for the OpenCode plugin and automation.
oo gateway --help Print gateway command usage.

Plugin behavior

When OPENCODE_REMOTE_GATEWAY=auto, the plugin tries to use the gateway if it is configured and reachable. If the gateway is missing, unavailable, or not configured, the plugin falls back to the current sidebar QR/proxy behavior.

When the gateway is active, the plugin registers with it and keeps the OpenCode sidebar small: gateway health, remote access state, QR setup when needed, and connected-client status.

The sidebar hides QR setup once a gateway client is connected. Before connection, it prefers the compact local gateway URL for sidebar QR size, while the gateway TUI can show the active gateway URL.

Workspaces

The gateway can reopen previously connected workspaces for Wake to Code. A workspace becomes known only after a local OpenCode plugin successfully registers it.

  • The app can request only a known workspace id. It cannot send arbitrary commands or paths.
  • The gateway uses the last command used to open that workspace.
  • If the workspace is already open, the gateway switches to that instance instead of starting another copy.
  • The gateway TUI shows registered instances and recent workspaces for desktop visibility.

Configuration

Variable Default Description
OPENCODE_REMOTE_GATEWAY auto auto tries gateway then falls back to current plugin behavior. required requires gateway. off disables gateway mode.
OPENCODE_REMOTE_SECRET generated Use a static gateway secret. When set, automatic secret rotation is disabled.
OPENCODE_REMOTE_SECRET_ROTATION_SECONDS 30 Rotate the generated gateway secret after this many seconds while no client is connected. Use 0 to generate once on start and never rotate.
OPENCODE_REMOTE_MAX_CLIENTS 1 Maximum connected remote clients. Use 0 for unlimited clients.
OPENCODE_REMOTE_REQUIRE_CLIENT true Require the app's x-openremote-client header for gateway remote access.
OPENCODE_REMOTE_RESUME true Allow the same app client to reconnect with its previous gateway password after heartbeat loss or explicit disconnect, even if a new invite password has rotated.
OPENCODE_REMOTE_RESUME_SECONDS 28800 Reconnect grace window, in seconds, for saved resume credentials.
OPENCODE_REMOTE_MAX_CLIENT_ID true Use the app client id when enforcing OPENCODE_REMOTE_MAX_CLIENTS.
OPENCODE_REMOTE_MAX_CLIENT_IP false Include client IP in gateway max-client keys.
OPENCODE_REMOTE_MAX_CLIENT_USER_AGENT false Include user agent in gateway max-client keys.

The saved gateway config also stores the last successful app port so stop/start and restart can keep QR URLs stable when the port is still free.