Skip to content
NerveNerve

LAN and mobile HTTPS

Nerve refuses a non-loopback bind unless remote access is explicitly allowed.

Terminal window
npx @nervekit/desktop -- --host 0.0.0.0 --allow-remote

For mobile browsers, add self-signed HTTPS:

Terminal window
npx @nervekit/desktop -- --host 0.0.0.0 --allow-remote --mobile-https

HTTP defaults to 3747 and mobile HTTPS to 3748. The tray exposes setup/share URLs and the local certificate-authority download.

Trust the local CA

Section titled “Trust the local CA”

Nerve creates a stable local CA and host-aware leaf certificate under <NERVE_HOME>/tls. On POSIX systems the directory/key use restrictive modes, but Windows authorization relies on ACLs rather than POSIX mode bits.

Install the CA only on devices you control and verify the source device. Leaf certificates rotate when host names/addresses change while the CA remains reusable.

Token bootstrap

Section titled “Token bootstrap”

A shared UI URL contains the daemon token. The server exchanges ?token=... for a Strict, HttpOnly cookie and redirects to remove the query. APIs accept Bearer token or cookie; WebSockets can also bootstrap with a query token.

Use firewall rules and a trusted network. Stop remote binding when it is no longer needed.

Next steps

Section titled “Next steps”