Use your home server from Android

1. How it works

The interface loads from GitHub Pages in the Android browser and talks to 127.0.0.1:6883 on the tablet itself. The SSH client (ConnectBot or Termux) forwards that port to 127.0.0.1:6883 on the home computer, where the local server runs. Files, commands and MCP services are therefore the home computer's. Without a tunnel, the home computer can also be published through a reverse proxy.

• ZeroChat stays private: the server still listens only on 127.0.0.1; only SSH is reachable from outside.
• Port 6883: different from the default 6388, so the desktop ZeroChat and the tablet one can run side by side.
• Model at home: if you use LM Studio or another model server on the same computer, forward its port too (1234 for LM Studio) and point the profile to http://127.0.0.1:1234/v1.

2. Prepare the home computer

Harden sshd (recommended)

In /etc/ssh/sshd_config (or a file in /etc/ssh/sshd_config.d/), keys only and your user only; then restart the service (sudo systemctl restart sshd):

PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
AllowUsers user
AllowTcpForwarding local

Launch command

Run the server in the SSH session itself, from the project directory and without opening the home browser. There is no URL to copy: the tablet signs in on the page with the user name and password of the home account (section 3).

cd ~/projects/my-project && zerochat --no-browser --keep-server --port 6883

• Working directory: the cd picks the project directory, shown in the server header. You can change it later from the interface, in project mode.
• --keep-server: the Android browser stops sending heartbeats when the tab goes to the background; without this option the server would shut down a minute after switching apps. With it the page sends no heartbeats: it rereads the server state, or reconnects, when you return to the tab.
• Lives with the session: closing the SSH session stops ZeroChat along with any commands it is running. On reconnect it starts again with the same daily token; return to the tab and the page reconnects by itself.
• Path to zerochat: an SSH session with a forced or automated command does not load your full PATH. If zerochat is not in /usr/bin, use the full path shown by command -v zerochat.

Restricted key (optional)

To keep the tablet without a console at home, create a key pair just for it and add the public key to ~/.ssh/authorized_keys with these restrictions, on a single line. It can only open the tunnel to those two ports and launch ZeroChat:

restrict,pty,port-forwarding,permitopen="127.0.0.1:6883",permitopen="127.0.0.1:1234",command="cd ~/projects/my-project && /home/user/venv/bin/zerochat --no-browser --keep-server --port 6883" ssh-ed25519 AAAA… tablet

pty is required: with a terminal, closing the session sends ZeroChat the hang-up signal and it stops; without one it would keep running and holding the port.

3. Connect from Android

ConnectBot

1. In ConnectBot's public keys, generate an Ed25519 key and copy its public part to the home authorized_keys (section 2).
2. Create the host user@home with that key.
3. In the host's port forwards, add two of type Local: 6883 → 127.0.0.1:6883 and 1234 → 127.0.0.1:1234.
4. Connect. With the restricted key, the session accepts no commands: it only keeps the tunnel and ZeroChat running.

Without the restricted key, type the launch command in the console or put it in the host's post-login automation to run it on connect.

Termux

With the restricted key, just open the session, without -N, so ZeroChat starts:

ssh -i ~/.ssh/tablet -L 6883:127.0.0.1:6883 -L 1234:127.0.0.1:1234 user@home

Without it, pass the launch command with -t, so the session has a terminal and ZeroChat stops when it closes:

ssh -t -L 6883:127.0.0.1:6883 -L 1234:127.0.0.1:1234 user@home 'cd ~/projects/my-project && zerochat --no-browser --keep-server --port 6883'

In the browser

1. Open ZeroChat and open the Connection panel (the plug icon next to the settings wheel in the sidebar).
2. Turn off Local connection, enter http://127.0.0.1:6883 as the local server URL, leave Use proxy off and press Connect.
3. Sign in with the user name and password of the account running ZeroChat at home. The page stores the daily token, never the password.

• Local network access: if the browser asks to let the page access devices on the local network, allow it; without it the page cannot reach 127.0.0.1.
• Separate configuration: profiles, API keys and conversations are stored in the tablet browser, apart from the desktop ones. Create the profile for the home model there.
• Sign-in: the daily token expires at midnight, and the page then asks for the user name and password again without stopping the server. After 5 failed attempts in a row, ZeroChat rejects the next ones for 15 minutes.

4. Common situations