The server blocks repeated requests and password guessing by itself. The values below cannot be changed.
| Item | Limit |
|---|---|
| ID connect requests (per IP) | 10 per minute |
| ID connect requests (per host ID) | 20 per minute. ID connects from other accounts are counted separately. |
| Connection approvals for other accounts | 5 per minute per account, 3 per minute per account and host |
| Device registration (per IP) | 10 per minute |
| Concurrent connections | 16 per IP, 1000 for the whole server |
| Concurrent sessions per host | 8 (the host's default viewer limit is 4) |
| Sign-up, login and password change (per IP) | 10 per minute |
| Failed logins | A 15-minute lock after 10 failures in 15 minutes from the same email and IP, or 100 failures in 15 minutes for the same email |
IPv6 addresses are counted in /64 blocks.
The host also protects itself. If the device password for unattended access is entered wrong 5 times, it locks for 5 minutes up to 1 hour, and ID connects from other accounts are counted separately from the owner.
/api request that changes state must have an Origin exactly equal to RD_WEB_ORIGIN. If a user opens a different address, "The request was refused" appears.TRUST_PROXY to the number of proxies. If wrong, all users appear as the single proxy IP and hit limits together.TURN_TTL_SEC (600 seconds by default).| Data | Location |
|---|---|
The database signal.db and the server key server.key | Packages: /var/lib/tastedev-remote, Docker: the signal-data volume |
| Settings files | Packages: /etc/tastedev-remote, Docker: .env |
| Server connection history | The database (kept 90 days, metadata only with no content) |
| Host connection history | sessions.jsonl on each host computer |
If server.key is lost, every host must be registered again.
.env or /etc/tastedev-remote).The backup contains the server's secret key, so keep it somewhere safe. HTTPS certificates can be issued again, so they need no backup.