> ## Documentation Index
> Fetch the complete documentation index at: https://docs.heylinger.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Serve other computers on your network

> Let browsers and Computers on your network reach a Docker Compose server through port 3000, and secure it first.

A Docker Compose server answers only on `localhost` by default. To let other computers reach it, set four variables in `.env` and run Docker Compose again. Browsers and Computers then reach everything through port 3000.

Opening the server has a cost. Everyone on that network can reach it. Replace the public development secrets, put HTTPS in front of port 3000, and keep every other port private.

This page covers the four variables, the secrets, the HTTPS proxy, the other ports, and the limits for voice. It applies to the Docker Compose install in [Docker Compose](https://docs.heylinger.com/install/docker-compose.md). To serve several computers, use Docker Compose rather than the installer.

> [!WARNING]
>
> Plain HTTP exposes the Computer installer, the agent connection, and sign-in cookies to anyone on the network. Put HTTPS in front of port 3000 before other people use the server.

## Set the four variables

Four variables open the server to your network. Replace `192.168.1.10` with this computer's address.

**1. Generate a private secret seed**

Run this command and copy the output:

```bash theme={null}
openssl rand -base64 32
```

**2. Edit .env**

Set these variables in the `.env` file of your checkout:

```bash theme={null}
WEB_BIND_ADDRESS=0.0.0.0
WEB_PUBLIC_ORIGIN=http://192.168.1.10:3000
AGENT_RUNNER_PUBLIC_GATEWAY_URL=ws://192.168.1.10:3000/v1/runner-gateway
LINGER_SECRET_SEED=<output of: openssl rand -base64 32>
```

**3. Apply the change**

```bash theme={null}
docker compose up --detach --wait
```

Each variable has one job:

| Variable | What it does |
| - | - |
| `WEB_BIND_ADDRESS` | Sets the host address the Web port binds. `0.0.0.0` serves other computers on the network. |
| `WEB_PUBLIC_ORIGIN` | Sets the address users open in the browser. Computer installers and links use it too. |
| `AGENT_RUNNER_PUBLIC_GATEWAY_URL` | Sets the gateway address handed to Computers. Without it, no Computer connects, so no agent runs. |
| `LINGER_SECRET_SEED` | Seeds the credentials between services. It needs at least 32 characters. |

## Replace the public development secrets

Replace both public secrets before anyone else uses the server. The `.env.example` file ships a public seed and a public encryption key, so Docker Compose works on `localhost` without setup. Everyone has these values.

The server refuses to start with the public seed once `WEB_PUBLIC_ORIGIN` is not `localhost`, `127.0.0.1`, or `::1`. Replace both values yourself:

* `LINGER_SECRET_SEED` protects every link between services.
* `TEAMHUB_SECRET_ENCRYPTION_KEY` encrypts API keys that people save in Linger.

Generate each value with `openssl rand -base64 32`. Keep both in the ignored `.env` file or your secret store, never in Git. Anyone who holds either value can impersonate a service or read saved keys.

## Put HTTPS in front of port 3000

Use an HTTPS reverse proxy in front of port 3000 for any shared server. The Computer installer, the gateway WebSocket, and sign-in cookies all travel over that port.

With the proxy in place, set `WEB_PUBLIC_ORIGIN` to the HTTPS address. Set `AGENT_RUNNER_PUBLIC_GATEWAY_URL` to the matching `wss://` address. Add the proxy's address range to `TEAMHUB_TRUSTED_PROXIES`, so the server trusts the client address that the proxy forwards.

## Keep the other ports private

Only the Web port needs to be reachable from other computers. The root `docker-compose.yml` publishes PostgreSQL, the server API, and the Node services on `127.0.0.1` only. Keep it that way.

Change the PostgreSQL password from the development default before you open the server. The default user and password are both `simplexai`.

The development server from `pnpm dev` is for one developer on one machine. It binds to `127.0.0.1`. Do not expose it to a network.

## Can other computers use voice?

Not without more setup, and the public sources do not document all of it. Browsers allow the microphone only on `localhost` or HTTPS, so voice from another computer needs the HTTPS proxy first.

Voice audio also does not travel through port 3000. Browsers connect to the LiveKit server at `LIVEKIT_URL`, which defaults to `ws://127.0.0.1:17880`. The root `docker-compose.yml` publishes the LiveKit ports on `127.0.0.1` only. Test a real recording from another computer before you rely on it. [Enable voice](https://docs.heylinger.com/admin/voice.md) covers the voice keys.

## Keep learning

> [card] [Enable voice](https://docs.heylinger.com/admin/voice.md)
>
> Add the voice keys and use the microphone over HTTPS.

> [card] [Computer permissions](https://docs.heylinger.com/security/computer-permissions.md)
>
> Connect a Computer to the server and control its agents.

> [card] [Troubleshooting](https://docs.heylinger.com/admin/troubleshooting.md)
>
> Fix Computers that cannot connect.

> [card] [Environment variables](https://docs.heylinger.com/reference/environment-variables.md)
>
> See every variable Linger reads.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.