When running behind a reverse proxy (nginx, caddy, traefik, etc.), the
server sees the proxy's IP instead of the real client IP. The new
--trust-proxy flag makes the server read X-Forwarded-For and X-Real-IP
headers to extract the actual client IP. Falls back to the socket
address if no proxy header is present.
https://claude.ai/code/session_01Mp2BozcMQX2kWm4ZP9mxJw
iOS Safari silently rejects wss:// connections to servers using
self-signed certificates — the trust exception accepted for the page
does not extend to WebSocket handshakes. This causes the UI to hang
on "Establishing WebSocket connection..." indefinitely.
- Make --certificate and --key optional; server runs plain HTTP when omitted
- When TLS is enabled, also start a plain HTTP listener on --http-port
(default 8081) so iOS clients can connect via ws:// instead of wss://
- Add a 5-second connection timeout on the frontend that detects the hang
and shows a clickable link to the HTTP fallback URL
https://claude.ai/code/session_01VJ4CsBALnYcVhFJpY5cD5k
Modern browsers obfuscate local IP addresses with mDNS hostnames
(e.g. abcdef12-3456.local) for privacy. When mDNS resolution is
unavailable on the LAN, WebRTC ICE candidates cannot be resolved
and the peer connection fails.
This fix makes the signaling server extract each client's real IP
from the TCP connection and share it via Welcome/PeerJoined messages.
The client then replaces any .local mDNS addresses in SDP offers,
answers, and trickle ICE candidates with the peer's actual IP address,
enabling direct IP connectivity without relying on mDNS.
https://claude.ai/code/session_01EZrFdyAR35RLwRdHUA9zPJ
