Skip to main content
Most operations flow through the gateway (fased gateway), a single long-running process that owns channel connections and the WebSocket control plane.

​
Core rules

  • One gateway per host is the normal setup. A gateway owns its configured channel sessions and WebSocket control plane.
  • For rescue bots or strict isolation, run multiple gateways with separate profiles, state dirs, channel accounts, and ports. See Multiple gateways.
  • Loopback first: the gateway WS defaults to ws://127.0.0.1:18789. The wizard generates a gateway token by default, even for loopback.
  • For tailnet access, use either Tailscale Serve on top of loopback or an explicit tailnet bind with auth.
  • Nodes connect to the gateway WS over LAN, tailnet, or SSH as needed. The legacy TCP bridge is kept only for older node integrations.
  • Canvas host is served by the gateway HTTP server on the same port as the gateway (default 18789):
    • /__fased__/canvas/
    • /__fased__/a2ui/
  • When gateway.auth is configured and the gateway binds beyond loopback, canvas routes are protected by gateway auth.
  • Node clients use node-scoped capability URLs tied to their active WS session. See Gateway configuration (canvasHost, gateway).
  • Remote use is typically SSH tunneling or Tailscale. See Remote access and Discovery.