Docs / Internals

Access Model & Security

The local owner and subdevices connecting from other machines are separate trust boundaries.

Defaults

VYLINE_LAN_ACCESS=false
VYLINE_TRUST_REMOTE_OWNER=false

VYLINE_LAN_ACCESS does not directly choose the listen address. It controls remote-access behavior including LAN pairing. The Compose host-port bind is configured separately with VYLINE_BIND_ADDRESS.

Listen address versus exposure

If VYLINE_HOST is bound to a non-loopback address such as 0.0.0.0, Backend treats the deployment as remote even when VYLINE_LAN_ACCESS=false. Remote subdevice authentication is then mandatory, while owner authentication and pairing actions remain loopback-only; a startup warning is emitted. Being reachable from another machine does not make a deployment safely exposed. Design the bind address and authentication flags together.

TRUST_REMOTE_OWNER

With VYLINE_TRUST_REMOTE_OWNER=true, a remote peer that can reach Backend is trusted at the same level as the loopback owner. Use this only when access is restricted before traffic reaches Backend, for example by Cloudflare Access, Tailscale ACLs, or an authenticated reverse proxy.

Do not enable this on an unprotected LAN or Internet endpoint

This setting does not strengthen subdevice authentication. It promotes the remote peer to owner trust.

Secrets

.env
Cloudflare tunnel token
LINE token/session
data/, storage/
backup ZIP / account DB
Desktop E2EE key dump

Plugin trust

Plugins declare permissions and an account scope, but third-party plugins are executable code. Permission names alone do not make a plugin safe. Review the source before installation and do not enable plugins that request capabilities you do not need.