Skip to content
VarinDocs
EN

Remote Instances

The desktop app can connect to Varin running on another machine over SSH — a work server, a cloud box, a homelab — and bring its UI to your screen as if it were local. Set this up at Settings → Remote Instances.

Remote instances are a desktop-only feature. On the web, connect to a remote Varin server with a tunnel, a reverse proxy, or pairing.

Add a remote instance

Section titled “Add a remote instance”
  1. Open Settings → Remote Instances and add one.
  2. Give it the SSH command you’d normally use to reach the machine, plus a nickname.
  3. Choose how Varin runs there:
    • managed — Varin installs and starts itself on the remote machine
    • external — connect to one that’s already running
  4. Connect.

Varin walks through the steps — checking the connection, setting up the remote, starting the server, and forwarding the port — and shows where it is at each stage. When it reaches ready, the remote UI loads locally.

Credentials

Section titled “Credentials”

You decide whether to save the SSH and UI passwords or enter them each time. If the connection drops, Varin reports which step failed so you can fix it — see Remote access.

Section titled “Connection links”

If a remote machine already runs Varin, the easiest way to connect the desktop app is a pairing link. On the remote server’s UI, open Settings → Remote Instances → Connect to this server → Add a device, create a link, and import it on your desktop at Settings → Remote Instances → Other Varin servers → Import Link. See Connect a Device for the full flow.

A link created with Anywhere carries both a direct address and a Private Relay route: the desktop connects directly when it can reach the server (same network), and falls back to the end-to-end encrypted relay when you’re away. The status next to each saved server shows which route is in use.

You can also create a link from a terminal on the remote machine:

Terminal window
varin connect-url --port 3000 --server http://your-host:3000 --qr

connect-url starts the server first if nothing is running on that port. Add --api-only for a headless server, --lan to bind to the LAN when starting, --ui-password to protect browser access, and --name to label the saved connection. Add --relay for a link that also works away from the local network: the device prefers the direct connection when reachable and falls back to the Private Relay — the instance brings the relay up on its own.

The generated link contains a single-use pairing secret. Once imported, the device holds its own client token — separate from the browser UI password — which survives server restarts until you revoke it on the issuing server.

Section titled “Related”