Remote operation

Operating from anywhere, without ever exposing the radio to the internet.

First: a real address at home

Before any remote-access setup, one button fixes the daily annoyance of certificates on your own network. In Settings under A name for your own network, Get my shacknerd.com address gives this daemon a permanent address built from your callsign, like w2nrd.s.shacknerd.com, claimed automatically from the callsign in your settings, first come first served. It resolves to this machine's LAN address and comes with a real Let's Encrypt certificate that renews itself. Bookmark it on every phone and laptop in the house: green padlock, working microphone, nothing to install anywhere, and no warnings ever. (If your callsign is already claimed, you still get a permanent hash-based name; the callsign is the convenience, the hash is the guarantee.)

Your radio traffic never leaves your network; only the name and this machine's private addresses are published, the same trade Plex users have accepted for a decade. Like any name, it needs DNS: with your internet down, the plain http://<this machine's IP>:7300 shown in the enrollment note keeps working, because the radio itself never depends on the internet. Needs an access password set first, like everything reachable by name. The security page explains why ShackNerd refuses the port-forwarding shortcut; this page is the path that works.

The short version

Your radio talks only to ShackNerd on your home network. You reach ShackNerd over an encrypted tunnel, protected by a real password and HTTPS. Tailscale provides the tunnel free for personal use, with no router configuration at all.

Step by step

  1. Set an access password. In Settings → Access password, set one. Every remote feature refuses to work without it, on purpose. Once set, every device signs in, and repeated wrong guesses lock the login out for a few minutes.
  1. Install Tailscale on the ShackNerd machine and on your phone, from tailscale.com, signed into the same account. In the Tailscale admin console under DNS, enable HTTPS certificates.
  1. One click in ShackNerd. Open Access and remote. It shows what Tailscale is doing on the machine and, once it is running, a Set up remote access button. That button obtains a real HTTPS certificate for the machine's tailnet name, stores it, and switches ShackNerd over to it without a restart.
  1. Operate. From anywhere your phone has signal, open the address the panel shows, something like https://shack-pc.your-tailnet.ts.net:7300, sign in, and everything works: waterfall, audio, and because it is HTTPS, your microphone for transmit.

Why HTTPS matters here

Browsers only allow microphone access on secure pages, so voice transmit from your phone requires it. The Tailscale certificate is a real one, so there are no browser warnings to click through.

Certificates of your own

Under Advanced in the same panel you can point ShackNerd at any certificate and key files, choose the listen address, and set the hostname it answers to. Requests arriving under any other name are refused, which is part of what keeps a random website from reaching your daemon through your browser.

If a saved setting locks you out

Command line flags override saved settings for one run: shacknerd -listen :7300 starts with the default listener no matter what was saved, so there is always a way back in from the machine itself.

Share your station, view-only

Share your station in Settings makes a link anyone can open: they see the live waterfall, hear the audio and read the decodes, and can touch nothing. The restriction is enforced by the daemon, not the page, so the link is safe to hand out: an elmer watching your first contact, your club during a special event, or a stream overlay. New link revokes the old one everywhere at once; so does turning sharing off.

Sharing beyond your LAN

The link decides what a viewer can do; your network decides who can reach it at all. In order of effort:

Same network: nothing to do. Anyone in the house or at the club opens the link and it works. This covers most club and family cases.

A friend elsewhere, with Tailscale: share the machine. Tailscale can share a single machine with someone else's Tailscale account, free on personal plans:

  1. In the Tailscale admin console, find the ShackNerd machine, open its menu, choose Share, and send the invite to your friend's email.
  2. They install Tailscale, sign in with any account, and accept.
  3. Send them the spectate link with your tailnet address in it, the same https://shack-pc.your-tailnet.ts.net:7300/spectate?key=... form the panel shows you.

They can now watch from anywhere. The share is to the machine, not your whole tailnet, and you can revoke it in the same console.

Anyone at all, no software: Tailscale Funnel. Funnel publishes the daemon to the public internet over HTTPS at your machine's tailnet name, so a viewer needs nothing but the link:

  1. Enable Funnel for your tailnet when asked (the command walks you through it), then on the ShackNerd machine: tailscale funnel 7300
  2. Your station is now reachable at the address Funnel prints. Send the spectate link built on that address.
  3. tailscale funnel off ends it.

Being publicly reachable is exactly what the access password and the view-only link are for: a stranger with the spectate link gets the read-only station, and everything else asks for your password. Funnel's bandwidth suits a handful of viewers, not a crowd. Turn it off when the show is over; standing exposure you are not using is never worth keeping.

Port forwarding: still no. The security page explains why, and nothing about sharing changes it.

Streaming to Twitch or YouTube does not need any of this: OBS runs on your own machine, captures the spectate page from your LAN, and your stream platform does the distribution. The spectate page is designed to be a clean capture source, no controls, no settings, just the station.