Away from home
Watch your library from anywhere with your own domain, a relay you run yourself or a Cloudflare tunnel. It stays off until you turn it on.
Off until you say so
Nothing is reachable from the internet until an admin turns on remote access.
Your own domain
Basement gets a Let's Encrypt certificate for a domain you own.
A relay when you can't open a port
Apps reach your server through a relay when your router won't let them in directly.
Cloudflare tunnel
Connect a Cloudflare tunnel from Admin, and Basement sets up the records and the connector.
Apps find the way themselves
Phones and TVs try your home network first, then tunnels, then a relay if you set one up.
At home, apps find your server on the network by themselves. Away from home they need a way in, and Basement gives you three: your own domain with automatic certificates, a relay you run yourself (Basement ships the relay program), or a Cloudflare tunnel you already have.
Port forwarding can be automatic, but Basement only does it after you switch it on. Apps only send sign-in tokens to the address they were issued for.