Reaching Quasar remotely

Do not expose Quasar directly to the internet

Quasar has not been security reviewed or hardened for public traffic. Use a VPN. If you expose it anyway, the risk is yours and it is unsupported.

Why a proxy is not enough

Login and signaling go to the control plane over HTTPS, and proxy fine. The stream is WebRTC directly between the browser and the GPU host, so the two must reach each other by IP. A proxied login page with no route to the GPU host gives you a login and no stream.

Use a VPN

WireGuard or Tailscale put the client on the same network as the GPU host, so Quasar behaves as on a LAN.

• Add the VPN address to the certificate (QUASAR_TLS_HOSTS). See HTTPS and certificates.
• The VPN must carry UDP with low latency. A relayed Tailscale connection adds the relay’s latency.

On a LAN

Use an address covered by the certificate, and allow the required ports between the client and host.

Signaling through a proxy

If you proxy the control plane, preserve the browser-facing address and configure allowed origins. The settings differ for current and legacy installs: see Behind a reverse proxy.

When login works but sessions do not

Check the direct network path first:

1. In Admin ▸ Sessions, check whether the session is still starting or is running with a black screen.
2. ICE stuck at checking in the browser console means no candidate pair worked.
3. Check the selected candidate pair in the browser’s WebRTC diagnostics and confirm the client can route to the GPU host.