ovenlight

<p align="center"> <img src="site/icon.svg" width="128" height="128" alt=""> </p> <h1 align="center">Ovenlight</h1> <p align="center"> <strong>Cooking up apps with AI? Serve them to the people you made them for, and no one else.</strong><br> Your web apps run on your own computer, stay off the internet and open on your phone, behind Face&nbsp;ID or your fingerprint. </p> <p align="center"> <a href="https://apps.apple.com/app/id6817561066"><img align="absmiddle" src="site/images/app-store-badge-black.svg" width="150" height="50" alt="Download on the App Store"></a> <a href="https://play.google.com/store/apps/details?id=com.snowyghost.ovenlight"><img align="absmiddle" src="site/images/google-play-badge.png" width="194" height="75" alt="Get it on Google Play"></a><br> _{Got an invite? Install Ovenlight, then open your invite link again. Here's <a href="https://ovenlight.app/privacy#inviter">what the person who invited you sees</a>.} </p> <p align="center"> <a href="#get-started">Get&nbsp;started</a> · <a href="#with-a-coding-agent">With&nbsp;your&nbsp;coding&nbsp;agent</a> · <a href="#share-an-app">Share&nbsp;an&nbsp;app</a> · <a href="#security">Security</a> · <a href="https://ovenlight.app">ovenlight.app</a> </p> <p align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="site/images/launcher-dark-480.jpg"> <img src="site/images/launcher-480.jpg" width="30%" alt="The Ovenlight launcher on an iPhone: apps such as Recipe Box, Trip Planner, Book Club and House Guide, laid out like a Home Screen in warm light falling from the Dynamic Island."> </picture>&nbsp; <picture> <source media="(prefers-color-scheme: dark)" srcset="site/images/join-house-guide-dark-480.jpg"> <img src="site/images/join-house-guide-480.jpg" width="30%" alt="An invite in Ovenlight asking: Join Dimitri's House Guide? It says Dimitri invited you as Sam, that House Guide runs on Dimitri's computer and that you don't need an account, and offers Join and Not Now buttons."> </picture>&nbsp; <picture> <source media="(prefers-color-scheme: dark)" srcset="site/images/house-guide-dark-480.jpg"> <img src="site/images/house-guide-480.jpg" width="30%" alt="House Guide on Sam's iPhone, open full screen in Ovenlight: a greeting to Sam, a search field, a drawing of the house at dusk, a welcome note from Dimitri, what's next for Biscuit the dog and the Wi-Fi password."> </picture> </p>

You built a small web app for your family, your garden or your book club, maybe in an afternoon with a coding agent, and it runs on your own computer. Ovenlight puts it on your phone and on the phone of anyone you invite, and it opens wherever the phone is online, at home or away. It takes a computer that stays on, with Ovenlight's connector installed, and a Tailscale account of your own (free for personal use). The people you share with need only Ovenlight.

Once your computer is set up and your agent connected, ask it to put the app on your phone:

You: Make a chore chart for the kids and put it on my phone.

Your agent reads Ovenlight's building guide, builds Chore Chart on your computer, publishes it and checks it.

Your agent: Chore Chart is ready. It will show up in Ovenlight on your phone once you sign in with your Tailscale account at this link: https://login.tailscale.com/a/…

What you get

• Friends join with a link and a tap. A friend installs Ovenlight, opens your invite and taps Join, with no account and nothing to sign in to. The app arrives marked with your name.
• Share one app, not your computer. A friend's phone reaches only the apps you shared with it, and none of your other devices. When you stop sharing, their access ends at once, and the app and its data leave their phone the next time Ovenlight connects.
• Nothing to deploy, no login to build. The app stays on your computer, off the internet. Ovenlight's connector, a program that runs beside it, gives it an HTTPS address in your Tailscale network and tells it who is calling. Any web app that serves plain HTTP on 127.0.0.1 can sit behind it, AI-built or not.
• Your coding agent does the publishing. Through the connector's MCP server, your agent can publish the app, check it, read its logs and read the notes and screenshots people send from inside it. Inviting people is up to you: Ovenlight gives the agent no tool for it.
• It opens like an app. Full screen, from its own icon, in a launcher that works like your phone's home screen, with its storage kept apart from the others. One unlock, with Face ID or your fingerprint, opens them all.
• Private, free and open source. There's no Ovenlight account, no analytics and no ads. Phones reach your computer over a Tailscale connection built into Ovenlight, never through servers of ours. No phone needs a VPN or the Tailscale app. The iPhone and Android apps and the connector are free, under the Apache License 2.0. It's made by Dimitri Cole at Snowy Ghost.

Why not a VPN, a tunnel or the cloud?

• A VPN and a bookmark work for you. A friend would need a VPN app and an account, and unless you write access rules for them, they'd reach your computer, not just one app. With Ovenlight they get one app with its own icon and nothing to set up, and Ovenlight drafts the rules for you to approve.
• A tunnel or an open port works in any browser, on any phone, but puts the app on the internet, where the app or the tunnel has to keep strangers out. Ovenlight keeps the app off the internet and turns away anyone you didn't invite.
• A cloud host keeps the app up while your computer is off, but puts the app on the internet and its data off your computer. Ovenlight keeps both on your computer, which has to be on and awake while people use the app.

How it works

%%{init: {"flowchart": {"wrappingWidth": 400}}}%%
flowchart LR
  you["Your phone"] --> rb & cc
  sam["Sam's phone"] -- "invited to Recipe Box" --> rb
  subgraph computer["Your computer, running the connector"]
    rb["Recipe Box<br>recipe-box.your-tailnet.ts.net"]
    cc["Chore Chart<br>chore-chart.your-tailnet.ts.net"]
  end

• The connector (the ovenlight command, in connector/) runs on the computer with your apps. Built on Tailscale's tsnet, it makes each app its own device in your Tailscale network (your tailnet), with an HTTPS address, and passes each request on to the app at 127.0.0.1 with headers that say who is calling. It also manages your guests and serves the MCP tools your coding agent uses.
• The iPhone app (in Ovenlight/) carries its own Tailscale node, built with TailscaleKit. It finds the apps you publish and opens them.
• The Android app (in android/) does the same, with a Tailscale node built from Tailscale's tsnet.

When you share an app, your friend's phone joins your tailnet as a guest device. Security says what it can reach and how that's enforced.

What you need

• A computer that stays on and awake while anyone uses your apps: a Mac with macOS 13 or later, logged in to its desktop; a Linux computer with systemd, such as Ubuntu; or a Windows 11 PC. A laptop must stay open, since closing its lid puts it to sleep, and Windows sleeps when idle until you turn that off.
• An iPhone with iOS 18.1 or later, or a phone with Android 10 or later, and Ovenlight from the App Store or Google Play, for you and for everyone you share with.
• A Tailscale account, for you only. The people you share with need none, and no phone or computer needs the Tailscale app. Tailscale's free Personal plan is for non-commercial use, so a business needs one of Tailscale's paid plans. Each shareable app and each guest's phone is a tagged device, which Tailscale's plans count. The free Personal plan includes a set number and charges for more (details).

docs/connector.md says how the connector runs on each system, including on a Mac without a display. To build either app yourself, see docs/development.md (iPhone, Android). Headscale is supported for development only.

Get started

1. Turn on HTTPS certificates

In the Tailscale admin console, under DNS, turn on MagicDNS if it's off, then turn on HTTPS certificates. Each app gets its own HTTPS address in your tailnet, and Ovenlight opens apps only over HTTPS.

2. Install the connector

Follow the steps for your computer's system. On each, the script installs the ovenlight command and keeps the connector running.

Mac

In Terminal:

mkdir -p ~/ovenlight-connector && cd ~/ovenlight-connector
curl -fsSL https://downloads.ovenlight.app/connector/latest/ovenlight-connector-macos.tar.gz |
  tar xz --strip-components 1
./install.sh

If the script prints a line for your shell profile, as it does on a new Mac, add it:

echo >> ~/.zshrc
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc

Then open a new Terminal window, so the commands below work as written.

Linux

In a terminal:

mkdir -p ~/ovenlight-connector && cd ~/ovenlight-connector
curl -fsSL https://downloads.ovenlight.app/connector/latest/ovenlight-connector-linux-amd64.tar.gz |
  tar xz --strip-components 1
./install.sh

On an Arm computer, use linux-arm64 in place of linux-amd64. If the script prints a line for your shell profile, add it to ~/.bashrc and open a new terminal. If it prints a sudo loginctl enable-linger command, run it, so the connector keeps serving with nobody logged in and after a restart.

Windows

Sign in as the account that will own the apps, which must be an administrator. Open PowerShell with Run as administrator, then run:

mkdir $HOME\ovenlight-connector -Force | Out-Null; cd $HOME\ovenlight-connector
curl.exe -fsSL https://downloads.ovenlight.app/connector/latest/ovenlight-connector-windows-amd64.zip -o connector.zip
tar -xf connector.zip --strip-components 1
powershell -ExecutionPolicy Bypass -File .\install.ps1

On an Arm PC, use windows-arm64 in place of windows-amd64. The ovenlight command works in PowerShell windows opened after the install.

Updating

To update, run the same install commands again when ovenlight doctor says a new release is out. docs/connector.md also covers downloading in a browser and checking a download's signature.

3. Publish an app

Public certificate logs list each app's address with your tailnet's name in it, so pick app names you don't mind people seeing.

With a coding agent, connect it and ask it to put your app on your phone. It publishes and checks the app, and asks you for the steps only you can do, such as opening the login link.

To publish it yourself, run your app on the same computer, on a port nothing else uses. It must serve plain HTTP on 127.0.0.1, and serve static files only from a public folder, never from the project's folder with its data and code. Then publish it with its port:

ovenlight publish --port 4317 --name "Recipe Box"

Recipe Box becomes its own device in your tailnet, at https://recipe-box.<your-tailnet>.ts.net/. For each new app, publish prints a login link: open it and sign in with your Tailscale account. Once you store an API access token (see Share an app), later apps sign in witho