Pixel Bridge
Pixel Bridge gives Pixel Brite remote access without rebuilding its HTTP stack. URLSession, AVPlayer, and PocketBase keep their existing requests, range reads, and authentication. A Rust bridge carries that traffic over Iroh to a server behind NAT, with no inbound port forwarding.
URLSession and AVPlayer send HTTP to a local Pixel Bridge client. It carries the traffic over an end-to-end encrypted Iroh connection to a server-side bridge, which forwards it over loopback to PocketBase and the media service.
HTTP on both sides
On the device, a Rust XCFramework listens on loopback for ordinary HTTP requests from URLSession and AVPlayer. It carries those requests over Iroh to a Rust process on the server, which forwards them over loopback to PocketBase or the media service. Responses return along the same path.
PocketBase still owns its routes, auth tokens, and realtime updates. AVPlayer still makes byte-range requests and handles caching and seeking. Downloads keep their existing HTTP range-resume behavior because none of those components sees a new protocol.
Endpoint IDs and network paths
A Pixel Brite server profile identifies the server by its Iroh Endpoint ID. Signed bootstrap data and Iroh’s address lookup supply the current direct-dial and relay information. Iroh dials the available paths, promotes a direct path when it can establish one through NAT, and keeps relay paths available when the network will not permit a direct connection. Relayed packets remain end-to-end encrypted.
Two dedicated Pixel Brite relays keep the server reachable when direct dialing fails. The server maintains registration with both, so losing one relay does not also lose discovery. Connections prefer direct QUIC and use a relay when the network requires it.
Installation and user access
The server bridge accepts application traffic only when the Client Endpoint ID appears in its live allow-list. PocketBase then validates the auth token on each request. The first check decides whether this installation may reach the server; the second applies the signed-in user’s permissions.
The first installation signs in and saves a membership enrollment capability in private, encrypted CloudKit storage. Another Apple installation uses it to enroll its own locally generated keypair and receive a fresh PocketBase token. Each device keeps its secret key and auth token locally.
Revoking a device removes its Endpoint ID and closes its active connections. Revoking the membership also invalidates enrollment and disconnects every installation registered under it. Device access and account permissions can change independently.
Route changes and playback recovery
Iroh can migrate a live connection as an iPhone moves between Wi-Fi and cellular or a VPN changes its addresses. If the connection still breaks, Pixel Brite reconnects, resolves a fresh media URL, and reloads playback from the last confirmed position.