Docs
Reach it from your phone
Tailscale, your Wi-Fi, USB, and WSL2 notes.
The phone must reach port 7444 on the server. Tailscale is the route I recommend: it works from any network, it is encrypted end to end, and nothing is exposed to the internet. The others are for special cases.
Put Tailscale on the server and the phone
bash curl -fsSL https://tailscale.com/install.sh | sh # on the server (Linux) sudo tailscale up # sign in; use the same account on the phone tailscale ip -4 # the server's address, 100.x.y.zInstall the Tailscale app on the phone and sign in with the same account.
Use that address in the app
The address is
ws://100.x.y.z:7444/v1/session. You do not type it: the pairing QR code carries it (next page).
The tunnel is encrypted by WireGuard, so plain ws:// inside it is fine for the debug build of the app.
Fine at home, where the phone and the server are on the same network. Core must listen on an address the phone can reach, and that requires pairing (or a token): core refuses to listen beyond loopback otherwise.
Find the server's LAN address
scripts/dev-core.sh --infoprints every address it answers on, with the Tailscale one marked. For a service, setAVNI_LISTEN=0.0.0.0:7444.Allow the port in the firewall
Allow inbound TCP 7444 on the server, for your home network only.
No network at all: the phone reaches the server through the USB cable. Good for a first test on one machine. Core can stay on loopback, with no token and no pairing.
adb reverse tcp:7444 tcp:7444Then use ws://127.0.0.1:7444/v1/session in the app (Settings, Connection). It only works while the cable is connected.
WSL2 sits behind NAT by default, so the phone cannot see a server running inside it. Two ways round that; mirrored networking is the one I use.
Mirrored networking (recommended)
In %UserProfile%\.wslconfig on Windows:
[wsl2]
networkingMode=mirroredThen in PowerShell run wsl --shutdown and reopen WSL. Allow inbound TCP 7444 in Windows Defender Firewall (an elevated terminal is needed for the rule).
Install Tailscale on the Windows host, not inside WSL. With mirrored networking, WSL sees the same addresses, so the server is reachable on the host's 100.x.y.z address.
Port proxy (NAT mode)
netsh interface portproxy add v4tov4 listenport=7444 listenaddress=0.0.0.0 connectport=7444 connectaddress=<WSL ip>plus a firewall rule. The WSL address changes on restart, so you must redo it.