Reach Sessionboxer from your phone: Cloudflare, Sessionboxer tunnel or SSH

Pair another device is a menu: Local network (the address the Control Plane listens on, for a phone on the same Wi-Fi), Cloudflare quick tunnel, Sessionboxer tunnel and Own server over SSH. Each of the three tunnels is an outbound connection from the Control Plane to something on the internet, so nothing is opened on the home router; picking one switches it on if it was off (the switch, its address and its last error live in the same section), and the QR / link is made with that tunnel's address once it is up — so the phone side is always: scan, tap, logged in. The tunnels you switch on stay on across restarts of the Control Plane; their programs stop with it and are restarted with back-off if they die. Several can be up at once, and a phone paired through one keeps working through any of them (the cookie is for the device, not the address).

Whatever the transport, the access token is the only wall: anonymous requests through a tunnel get a 401 exactly as on localhost, and a tunnel's forwarded headers (X-Forwarded-For, so the device list shows the phone's address, and X-Forwarded-Proto, so cookies are Secure) are only believed on requests that arrive from that tunnel's program on this machine carrying the tunnel's hostname. SESSIONBOXER_PUBLIC_URL is not touched by any of them — configured links and the GitHub OAuth callback keep using it.

• Cloudflare quick tunnel — zero setup, changing address. The Control Plane downloads cloudflared on first use (a pinned release, SHA-256 checked, kept in ~/.sessionboxer/bin; an installed one on the PATH is used instead) and runs cloudflared tunnel --url to itself: a random https://<four-words>.trycloudflare.com with a real certificate, no Cloudflare account, no DNS. Traffic passes Cloudflare's edge, TLS-terminated there and re-encrypted to your machine, and the address changes every time the tunnel starts (paired phones stay logged in; bookmarks go stale). Quick tunnels are Cloudflare's try-out tier: no uptime promise, rate limits, may be changed or discontinued. SESSIONBOXER_CLOUDFLARED_VERSION picks another release (checksums then read from the release notes).
• Sessionboxer tunnel — stable address, no account: https://<name>.tunnel-sessionboxer.talayolabs.com. The Control Plane downloads frpc (frp, pinned, SHA-256 checked, ~/.sessionboxer/bin/frpc) and connects it over TLS to the project's frps server at frps.tunnel-sessionboxer.talayolabs.com:443, which routes the hostname to your machine; the server's certificate (the same Let's Encrypt one your phone sees) is verified against the roots this machine trusts — first by the Control Plane, before the secret is sent anywhere, then by frpc on every connection (transport.tls.trustedCaFile) — so a server that cannot prove its name gets nothing but an error in Settings. The name is yours to pick (default: this machine's hostname; 3–40 lowercase letters, digits and dashes; the field checks availability as you type) and is bound to a secret the Control Plane generated into config.json at first start — the first machine to log in with a name owns it, another secret is refused, so nobody can take your address; forget the secret (a fresh ~/.sessionboxer) and the name is gone with it. Traffic passes the tunnel server (Hetzner, Finland — so latency is phone→Helsinki→you), where TLS is terminated (as at Cloudflare's edge) and re-encrypted to your machine; it keeps connection counts and bytes per name for its usage graphs, not content. Any server that speaks the same small API can be entered instead (the Server field; deploy your own from talayolabs/sessionboxer-tunnel, which also has Prometheus + Grafana). SESSIONBOXER_FRP_VERSION picks another frp release.
• Own server over SSH — a machine you already have with a public address and sshd: the Control Plane runs your system ssh -N -R to it (user, host, port, key file — or your agent — with host keys checked on first use and remembered), so the server's <remote port> forwards to the Control Plane. Choose bind: all addresses and the phone opens http://<host>:<remote port> — this needs GatewayPorts yes (or clientspecified) in that server's sshd_config and the port open in its firewall — or bind: localhost only with a reverse proxy on the server (Caddy, nginx) in front that has the certificate, and enter the public URL it serves. Plain http:// works for the chat, desktop and terminals but browsers only allow the clipboard, notifications and the VS Code pane from a secure context, so prefer the proxy with HTTPS for daily use.