Network Documentation

Tape is a hub-and-client system. One machine owns the archive. Paired devices reach that hub over an application network — not a machine VPN, and not a public music host.

Product name: Tape Private Network. Transport: Iroh (opens in a new tab). Older docs may still say Personal Private network; it is the same path.

For pairing steps, licensing, and public share pages, use Pairing & Remote. This page is the topology.

Topology

                         ┌─ Phone (iOS / Android)
Audio files ─ Hub ───────┼─ Extra Tape computers (clients)
Catalog / API            └─ Same hub, more paired devices

The hub is the desktop app or a Docker/NAS server. It keeps the files, the catalog, pairing, and stream generation.

Clients browse that catalog and request playback. They do not receive a copy of the library. They do not join the host computer’s LAN as a VPN peer.

Application network

Tape Private Network lives inside Tape. Each install is an endpoint with a cryptographic identity. After pairing, a client dials that hub, not “whatever machine is on this Wi‑Fi.”

That is the difference from a mesh VPN:

	Tape Private Network	Machine VPN (e.g. Tailscale)
What joins	The Tape app	The operating system
Who you dial	The paired hub identity	An IP on an overlay
Extra app	No	Usually yes
Library access	Tape pairing + session auth	Orthogonal to the music app

Iroh is the pipe. Tape still decides who may browse. Relays, when used, forward encrypted bytes. They do not host the catalog or the files.

How a device connects

The client stores one hub identity. It picks a route in this order:

LAN / same Wi‑Fi — HTTP to the hub on the local network. Preferred. Lowest latency. Highest available quality.
Tape Private Network — QUIC to the hub’s Iroh identity. Direct when NAT allows; relay when it does not.
Optional public HTTPS — Cloudflare / public link, if you turned it on. Not required for away-from-home after a completed pairing.

Pair once. Later reconnects reuse stored identity and tokens. You do not re-scan a QR every time you leave the house.

Opening a transport is not permission. On Tape Private Network the hub still verifies the device session before protected API and media.

Away-from-home routes (Tape Private Network and public HTTPS) are licensed remote use. LAN is not.

What moves between devices

On a live, authenticated route the client talks to the hub’s existing HTTP API: catalog, artwork, playlists, playback, session.

Audio is streamed from the hub. The music folder stays on the hub’s disks.

Another Tape computer can sit as a client of the same hub. Same pairing model, same routes.

Two hubs can share a collaborative playlist after an explicit invite. That is not an open mesh and not a copy of either library.

What does not ride this network:

the filesystem of the music folder
unpaired devices
public /share/... pages (separate, operator-chosen items)

Trust

Pairing binds one device to one hub and issues credentials.
Tape Private Network traffic is end-to-end encrypted.
A public URL does not make the library public. Protected requests still need a paired client.
Presence or relay helpers are not a grant of library access.
Revoking a device on the hub invalidates that client.

Docker / NAS

Same hub, same network, no Electron shell.

TCP 38472 — web UI and API
UDP 42424 — Tape Private Network
advertise the host’s real LAN address, not a container-only 172.x address

Install steps: Docker Setup.

Continue

Pairing & Remote — pair a phone, public vs private access, license gate
Docker Setup — compose, ports, advertised IP
Troubleshooting — LAN, auth, remote-route failures
Architecture — runtime trust boundary
Why Iroh, not Tailscale (opens in a new tab) — design notes

Docker Setup Features