Skip to content

Operating Away From Home

The RigPlane web server has no login. Anyone who can reach its port can control the radio, including transmit: the listener itself is the boundary (see Application authentication removal). Keep that port off the internet and reach it only through a path you control.

Keep the Server Off the Internet

  • Do not forward the web port (8080 by default) on your router.
  • rigplane web listens on all interfaces by default (--listen 0.0.0.0), so everyone on the same network (guest Wi-Fi, an office, a dorm) can reach the port and key the transmitter. When you do not need access from the LAN, pass --listen 127.0.0.1 and come in through an SSH tunnel. When you do, use it only on a network you trust, or let a firewall admit only your own machines.

--host before the subcommand is the radio's address; --listen after web is the address the web server listens on:

rigplane --model IC-7610 --host 192.168.1.50 --user USER --pass-file .rigplane-pass \
    web --listen 127.0.0.1

Here 192.168.1.50 is the radio and 127.0.0.1 is where the web server listens.

Reach It Over an SSH Tunnel

From the remote computer, forward a local port to the station:

ssh -L 8080:localhost:8080 you@station

Then open http://localhost:8080. The browser treats localhost as a secure origin, so voice TX from the browser microphone works without a certificate.

Reach It Over Your Own VPN

With WireGuard, Tailscale or a similar VPN, open the station by its VPN IP address. Everyone else on that VPN can reach the port too, and with it the radio, including transmit, so use a VPN that only you (and people you trust with your transmitter) are on.

A host name with a dot in it works only if it ends in .localhost, .local, .home.arpa or .internal, or if you start rigplane web with --allowed-host <name>; otherwise the server answers 421 Misdirected Request.

A private-network http:// address is not a secure origin, so browser voice TX needs HTTPS with a certificate the browser trusts: see Browser microphone requirement.

Behind Your Own HTTPS Reverse Proxy

You can put your own HTTPS reverse proxy (or your own TLS-terminating tunnel) in front of rigplane web: the proxy speaks plain HTTP to RigPlane on the loopback upstream and HTTPS to your browser. Say the proxy serves https://station.example (a fictional name; use your own) and forwards to http://127.0.0.1:8080 on the station machine.

The browser then sends Origin: https://station.example, which is neither same-origin with RigPlane's own HTTP upstream nor a local name. Pass it explicitly:

rigplane web --listen 127.0.0.1 --trusted-origin https://station.example \
    --trusted-origin https://ops.example

--trusted-origin is repeatable and takes a serialized origin only — scheme http or https, host, optional port; no user, path, query or fragment, not even a trailing slash. https://station.example:443 and https://station.example are the same origin. An invalid value is refused at startup, before anything is served.

Two different headers are involved, and only these two count:

  • the public Origin — where the browser's page came from — is what --trusted-origin matches;
  • the raw Host header RigPlane receives on the upstream leg must still pass the Host allowlist above. A proxy that rewrites Host to 127.0.0.1:8080 needs nothing more. A proxy that preserves the public name (Host: station.example) must also be given --allowed-host station.example, or RigPlane answers 421 Misdirected Request.

The trusted Origin only admits the browser's Origin past the same-origin rule. The Host allowlist, configured read-only mode and transmit safety checks still apply. RigPlane never trusts Forwarded or X-Forwarded-* headers: only the actual Origin and raw Host headers count.

Exposure guidance: terminate TLS at the proxy, keep RigPlane's port on the loopback upstream (--listen 127.0.0.1), and let the proxy — not RigPlane — be the only internet-facing listener.

Configure authentication and access restrictions at that proxy for access over an untrusted network. Core continues to admit non-browser requests without an Origin header; listing a trusted page origin grants no user identity or per-user permissions (host_guard.py: same_origin_allowed, web_routing.py: _dispatch_http_request).

Keep RigPlane Next to the Radio

Run RigPlane at the station, on the same network as a LAN radio, and use the VPN or tunnel only between your browser and RigPlane. The radio's own LAN audio can break over tunnels that drop IP fragments (see LAN Audio Breaks Over WireGuard or Other UDP Tunnels), and browser audio can stutter over a VPN with jitter (see Audio Stutters Over VPN/Tailscale).