ArdUi
English · 简体中文
Roles — read this first
There are exactly three roles: M, ArdFerry and ArdUi. Each is configured with one thing only: an HTTPS domain. For ArdUi this is the existing server setting in config.json; nothing about the client's configuration changes. Keys are generated and kept by the programs themselves; they are not configuration.
| Role | Its one setting | Responsibility |
|---|
| M | its own HTTPS domain | The centre of one network. Registers devices and hands out their 6-character IDs, presence, passes signed connection requests between devices, keeps the list of ArdFerry nodes (probes each entrance, gives clients the working ones), address discovery and the network probe. Sees neither session content nor passwords. |
| ArdFerry | M's HTTPS domain | Forwards encrypted traffic when two devices cannot connect directly. Runs the unmodified official iroh-relay; works with a public IP, or behind a router with UPnP / NAT-PMP port mapping. Untrusted by design: anyone may run one and join a network. It cannot read or alter anything; it can see IP addresses, timing and traffic volume of what passes through it, and it could slow traffic down, so clients prefer direct paths and pick relays by measured quality. |
| ArdUi (client) | M's HTTPS domain (server in config.json) | Holds the device key (the device's identity). Connects peer-to-peer, falling back to an ArdFerry; authenticates the other device end to end. The controlled machine decides who may do what, and keeps its audit recording locally. |
One network = one M = one domain. Self-hosting means running your own network: Bob's domain and Li's domain are two separate networks that know nothing of each other and do not interoperate. The official network is just one such network. Everyone runs the same programs; only the domain differs.
Full definitions, keys and the remaining gaps between this design and the current code: ROLES.md.
High-performance remote access for Windows. Peer-to-peer and end-to-end encrypted, connect by a short device ID with no IP addresses, ports or virtual adapters to set up, and the directory server can be self-hosted with one command.
Website · Download · Self-hosting · Historical design notes (Chinese)
Current version: v6.10. The official server refuses clients older than v6.10; only signed-in devices can connect to others (sign in and register on the server's account page).
Why ArdUi
- High performance: direct UDP paths between devices, automatic fallback to a relay when no direct path exists, and low-latency desktop streaming through FRD.
- Peer-to-peer: data goes straight from one device to the other. The directory server only hands out device IDs and coordinates connections; it is never on the data path.
- End-to-end encrypted: every device has a permanent key whose public half is its identity. Identities are verified before any password is sent, and the server never receives passwords.
- Self-hostable: one command deploys your own directory server (Linux, HTTPS included). Everything is open source.
Built on ARD (Iroh).
This is the beginning of the README. Read the rest at the original. Read the full README ↗
