AstroEye quick start

Choosing a camera & settings

On first launch, AstroEye asks for your site location and — if a ZWO camera is present — lets you pick which camera to use. You can change any of this later from the Settings dialog (the gear button in the app window):

• Camera — pick from the detected ZWO cameras, or "Replay (demo)" to run without one. Applying a camera change takes effect immediately (live hot-swap, no restart). A selected-but-unplugged camera is shown as "(not detected)" and the app runs in demo mode until it reconnects.
• Site location — latitude/longitude, drives the dusk-to-dawn auto-record.
• Feed port and roof-status file — editable here too. Site, port, and roof changes are saved and apply the next time the engine starts.

Connect your phone

The iOS app (AstroEye for iOS) is a thin client of the same engine feed the desktop app and Home Assistant use — pair it once and it remembers the connection.

1. On the desktop, click Connect phone (top of the main window) to open the Connect a phone or tablet dialog. It shows a QR code encoding an astroeye://add link with the engine's address prefilled (LAN and Tailscale addresses are auto-detected where available).
2. In the iOS app, tap Scan (toolbar, engine list) and point the camera at the QR code. The engine is added and selected automatically — no typing an IP by hand.
3. Remote (off your home network): if the desktop and phone are both on your Tailscale tailnet, the QR code's Tailscale address works from anywhere, not just the LAN — no port forwarding, no new always-on service.

No camera on your phone, or scanning fails? Tap + in the engine list and enter the host/port shown in the dialog by hand instead.

Security

AstroEye's feed is designed for your home LAN and your Tailscale tailnet — not the open internet. The posture, and the knobs:

• API token (default on). First run generates a random token in config.json (api_token). It gates every control POST and the /settings read (which includes your site coordinates). The pairing QR embeds it automatically — scanning is all a phone needs. Setting api_token to an empty string turns the gate off (not recommended).
• Read endpoints are open on purpose. /snapshot.jpg, /stream, and status reads skip the token so Home Assistant and plain <img> tags work. Anyone who can reach the port can watch the sky feed — scope who can reach the port rather than exposing it.
• Bind address. bind_host in config.json (default 0.0.0.0) — set 127.0.0.1 for this-machine-only, or a specific LAN/Tailscale IP to pin one interface.
• Firewall (Windows installer). The inbound rule admits private networks (10/8, 172.16/12, 192.168/16) and Tailscale (100.64/10) only — a port-forward or DMZ mistake doesn't expose the engine to the internet.
• Remote access: use Tailscale. The QR pair link already offers your Tailscale address when one is detected. Don't port-forward.