Running a server

Remote access

Free automatic HTTPS addresses for your server, so it plays at watch.wrentv.com and away from home. No domain or reverse proxy needed.

Browsers only play video from secure (https://) addresses on a secure page like watch.wrentv.com, and you probably want to watch away from home too. Remote access solves both, automatically, for servers that use Wren TV accounts.

#What you get

A claimed server gets HTTPS addresses under wrentv.net, with a real certificate:

• https://192-168-1-20.<id>.wrentv.net:32500 for each address on your home network, and
• https://203-0-113-7.<id>.wrentv.net:<port> for your public address, when the server is reachable from the internet.

<id> is a random name assigned to your server. Each name simply points at the IP address written in it. Players try them all and use the fastest that works: the home address when you're home, the public one when you're out.

#Turning it on

Remote access is on by default. Check it in Manage → Settings → Remote access. The status line says one of:

#How it works

1. Port forwarding. The server asks your router to forward a port to it, with UPnP or NAT-PMP. If your router doesn't allow that, forward a port yourself (below).
2. Addresses. The server asks the Wren TV address service (api.wrentv.net) to publish its names. The service only publishes the public address after it has connected back to the forwarded port, so a published address always worked when it was published.
3. Certificate. The server gets its own wildcard certificate for *.<id>.wrentv.net from Let's Encrypt. It's stored in <data>/certs/direct/ and renewed automatically.
4. Publishing. The addresses go out with the server's heartbeat, so the web player and apps find them.

HTTP and HTTPS share port 32500, so http://<server>:32500 keeps working on your network.

#Forwarding a port by hand

If the status says your router didn't accept an automatic port forward:

1. In your router's settings, forward a TCP port (for example 32500) to port 32500 on the server's LAN address.
2. Enter that external port under Manually forwarded port, and save. Or set remote_access.public_port / WRENTV_PUBLIC_PORT.

A manual port replaces UPnP. You can also turn off Forward a port automatically if you don't want the server changing router settings.

#When it can't work

#CGNAT

Some internet providers share one public IP address between many customers (carrier-grade NAT). Then nothing from the internet can reach your server, and the status says so. Wren TV still works at home, with HTTPS. To watch away from home, ask your provider for a public IPv4 address, or use your own tunnel (below).

#DNS rebinding protection

Some routers and DNS filters (including some Pi-hole and pfSense setups) block DNS answers that point to private addresses like 192.168.x.x. Then the home addresses don't resolve, and viewers at home fall back to the public address. Allow wrentv.net in that protection to fix it.

#Using your own domain instead

If you already run a reverse proxy (Caddy, nginx, Traefik) or a Cloudflare Tunnel with HTTPS, set its address as the server's Public URL in Manage → Settings (public_url / WRENTV_PUBLIC_URL):

yamlpublic_url: https://wrentv.example.com

Players try it alongside the automatic addresses, after the home addresses. Make sure the proxy:

• passes Authorization and Range request headers through,
• doesn't buffer or cache /stream/ responses, and
• allows long-running requests (server-sent events at /api/events stay open).

Wren TV already sends the CORS headers watch.wrentv.com needs.

#Turning it off

Untick Enable remote access, or set remote_access.enabled: false / WRENTV_REMOTE_ACCESS=false. The server then only has http:// addresses, so watch.wrentv.com can't play from it unless you set a public_url.