Network and remote access
Keep it on this machine, share it on your LAN, or reach it from a phone.
By default the gateway answers only on 127.0.0.1:7477, so only the machine it runs on can reach it. Everything below is a deliberate step away from that.
Who can reach it
The first gateway start asks once, and Settings → Network or motita gateway setup changes it later:
| Answer | Result |
|---|---|
| This machine only (default) | Loopback. |
| The local network | Listens on all interfaces, with allow: ["lan", "!any"]. |
| Everywhere | Listens on all interfaces with no origin rules. |
gateway.allow is an ordered list of rules (lan, an address, a network, each optionally prefixed with !). The first match wins, and loopback is always allowed so you cannot lock yourself out. The token stays the real key; the rules say where it may come from.
Reaching it safely
- SSH tunnel.
ssh -N -L 7477:127.0.0.1:7477 the-hostmakes ithttp://localhost:7477on your computer, with nothing exposed. - Tailscale. If Tailscale is running, motita can publish the gateway with
tailscale serve: https on your tailnet name, reachable only from your own devices. Funnel (the public internet) is never used. - A TLS reverse proxy such as Caddy in front of a loopback gateway, or the gateway's own second https listener (
gateway.tls).
Why https matters
Browsers allow the microphone, desktop notifications and phone push only on https or localhost. A phone on the LAN over plain HTTP gets none of those, which is the usual reason to set one of the options above.
Notifications
When a pull request's CI ends, the page shows a toast. Phone notifications use standard Web Push from the gateway itself, so they arrive with the page closed. On an iPhone or iPad the page must be added to the Home Screen first (iOS 16.4 or later). Settings → Notifications has a test button for the whole path.