Glide Vizion

Remote access

Watch your cameras from anywhere — without port-forwarding, without exposing the NVR to the internet, and without your video transiting our servers.

The principle: client, not server#

The NVR is never exposed. It dials outbound to the Glide Vizion coordinator and holds that connection open, like a logged-in chat client. All coordination flows through that outbound channel — nothing on the internet ever initiates a connection to your recorder.

How video reaches your phone#

When you open your cameras remotely, the client picks the best transport that works:

  1. Direct — if you’ve set a trusted HTTPS direct_url that resolves to the daemon (for example your own Tailscale or reverse-proxy hostname), the client probes it briefly and uses it.
  2. WebRTC peer-to-peer — the coordinator brokers the introduction, then video flows directly between your phone and the NVR. It never transits our servers; the coordinator only ever sees the handshake.
  3. Secure tunnel fallback — when NAT blocks hole-punching, the daemon’s own outbound Cloudflare Tunnel carries the same HTTPS endpoints the LAN uses. As a bonus, the tunnel path reuses HLS, which is what lets iPhones play HEVC remotely.

Setup#

remote:
  enabled: true
  device_name: "Office NVR"
  # direct_url: "https://nvr.office.example"   # optional, probed first
  tunnel:
    enabled: true

Then sign in at glidevizion.com/app (or open the iOS app) — your recorder appears, and tapping it opens the same live grid, wall, and playback you get on the LAN.

Security#

Everything remote is gated twice:

  • The coordinator authenticates you (magic-link sign-in, passkeys, optional TOTP) and mints short-lived signed grants.
  • The daemon verifies the grant itself — its own auth, per-IP login throttling, WebSocket origin checks, and CSRF guards apply on the tunnel exactly as they do on the LAN.

Enable auth before turning on remote access. Footage itself still never touches our infrastructure — the coordinator brokers introductions; bytes go peer-to-peer or through Cloudflare’s tunnel, end to end encrypted.