Blog · Roadmap · · 3 min read
Remote is coming: your TV, anywhere, through your own Cloudflare
TunnelRez Remote will stream your PC to a TV that isn't on your network, through a relay you deploy in your own Cloudflare account. Here's the plan, and what it won't do.
Today TunnelRez works on one network. The PC and the TV sit on the same Wi-Fi or the same cable, and that's where it's fastest. But people keep asking for the obvious next thing, which is a TV somewhere else. A parent's living room, a cabin, the office.
That's TunnelRez Remote. It's a written spec right now, and we haven't built it yet. We want to show you the plan before it ships, because how it's built matters more than the fact that it exists.
The idea in one line
You run the relay, in your own Cloudflare account. We don't run a server in the middle, and your stream never touches anything of ours.
How it works
The relay is a Worker template you deploy yourself, with a "Deploy to Cloudflare" button or a plain wrangler deploy. It's small, and it does 3 jobs.
- A room. One Durable Object per owner keeps a WebSocket open for each device that's online. It uses hibernatable WebSockets, so a TV that's sitting there waiting costs you almost nothing.
- A device list. D1 holds your devices, their public keys, invites and an event log.
- TURN credentials. For networks that won't let 2 devices talk directly, it mints short-lived credentials for Cloudflare Realtime TURN for each session.
The Worker only carries small JSON messages for presence and the handshake. Video and audio never go through it, because Workers can't relay UDP and we don't want your stream depending on a Worker's CPU limits anyway. Media goes over QUIC on UDP, either straight from device to device or through TURN, encrypted end to end.
2 people, 2 places
The setup is built for the real case, where the person at the TV and the person at the PC aren't in the same house.
You add a TV on your relay's admin page and it gives you a one-time invite. It's 8 characters with no look-alike letters, it lasts 24 hours and it works once. The person at the TV types the relay address and that invite with the remote, or runs one adb command if they're the type. The TV makes its own key pair, enrolls, and shows "Connected to relay, waiting for a PC".
You add your PC the same way. Then you see the TV in the app as waiting, busy or offline, and you press Connect.
By default the TV asks first. It shows that a PC wants to stream to it, and the person there answers OK or No with the remote. No answer in 60 seconds means no. You can turn that off for a TV you own.
The security part
Keys are made on the devices and only public keys ever reach your Worker. So if someone somehow got your relay's database, they'd get a list of public keys and no way into a stream. Every message to the relay and every enroll call is signed. The admin page sits behind Cloudflare Access.
Picking a path
There's a mode for each kind of network, and you pick it per TV.
| Mode | Path | When |
|---|---|---|
| Auto | Local, then direct, then relay | Most people |
| Local | Same network, like today | Home |
| Direct | Device to device over the internet | Most home routers |
| Relay | Always through Cloudflare TURN | Hotels, offices, CGNAT on both ends |
| Tailscale | Your own tailnet | If you already run it |
Auto tells you which path it took, and the round trip it measured, on both the PC and the TV.
The same warning, louder
Everything we say about networks counts double here. The internet between 2 houses is the worst network you'll ever stream over, so Remote won't hit the numbers we get on a clean home link, and we're not going to pretend it will. When we have real numbers, they'll go in the run book next to the local ones, measured on a real TV like everything else.
We don't have a date yet. When it ships, it shows up in the release notes first.