Skip to content
VarinDocs
EN

Private Relay

Deployment requirement: Varin ships no relay service and no default endpoint. Set VARIN_RELAY_URL on the server to a ws:// or wss:// relay you run or trust; until then Anywhere is unavailable and the server never connects to a relay. The pairing and encryption behavior below applies once that relay is configured and reachable.

The Varin Private Relay lets your paired devices reach your server from anywhere — cellular, a café network, another city — without opening ports, setting up a tunnel, or exposing your machine to the internet. Once the server’s relay endpoint is configured and available, pair a device with Anywhere in Connect a Device to use it.

How it works

Section titled “How it works”

Your server opens an outbound connection to the configured relay server and keeps it alive. When one of your devices is away from your network, it connects to the relay too, and the relay passes encrypted traffic between the two. Nothing on your machine listens for incoming connections from the internet.

When a direct connection is available — you’re back home on the same Wi-Fi — your devices prefer it and skip the relay entirely.

What the relay can and cannot see

Section titled “What the relay can and cannot see”

The relay is a blind courier, not a middleman:

  • End-to-end encrypted. Your device and your server agree on encryption keys directly with each other. The relay forwards sealed traffic it has no keys for — it cannot read your code, your prompts, or your passwords.
  • Only your devices can connect. A device must hold a token issued by your server through one-time pairing. Nobody can discover your server through the relay or connect to it without a token you created — and you can revoke any token at any time.
  • Pairing links are single-use. A pairing QR code works exactly once and expires if unused, so a leaked old link is worthless.
  • Nothing is shared until you opt in. The relay stays off until you enable it or pair a device over it, and you can disable it at any time — devices connected through it are cut off immediately.

When it runs

Section titled “When it runs”

The relay manages its own lifecycle — there is no switch to remember:

  • It starts on demand. Creating an Anywhere pairing turns the relay on, and it comes back after a restart for as long as any paired device still relies on it.
  • It stops on its own. Once no device or pending pairing uses the relay — for example after you revoke the last relay-paired device — it shuts down automatically.

Settings → Remote Instances → Connect to this server shows each paired device and whether it is connected through the relay. Revoke a device there to cut its relay access off immediately; devices on your local network are unaffected.

Relay or a tunnel?

Section titled “Relay or a tunnel?”
  • Use the relay to reach your own server from your own paired devices. Once the server’s relay endpoint is configured and available, no port forwarding or separate tunnel setup is needed.
  • Use a tunnel when you need a plain public URL — for example to open Varin in an ordinary browser on a machine you can’t pair, or to share access behind a UI password.
Section titled “Related”