Put Your Radio on the Internet

A real HTTPS entry for this machine — no public IP, no port forwarding, no dynamic-DNS scripts.

☁️ What you get

One address, reachable from anywhere, with a genuine certificate:

https://<callsign>-legacy.mrrc.vlsc.net/

For this product the label always carries the -legacy suffix, so it never collides with the Modern instance on the same callsign. The tunnel dials out from your machine; nothing on your router is opened, and no public IP is required.

🧭 Three steps

#What you doNotes
1Open ☁️ Cloud Hub — the button on the main UI, or ☁️ Connect to cloud in the mobile menuOpens cloud.html on this machine
2Enter your callsign, and optionally a contact addressThe maintenance team verifies it against the club registry
3Press ApplyStatus moves from "request submitted" to "approved"

Already approved and given a registration secret? Paste it in the same form and connect immediately — no waiting.

🔁 What happens after approval

Nothing for you to click:

  1. This machine asks the portal once every 30 seconds whether it was approved;
  2. It signs its own certificate for <label>.mrrc.vlsc.net and registers only the public key with the hub;
  3. It writes the tunnel configuration and starts frpc;
  4. It restarts itself so the new certificate is the one actually being served.

The application reports what it last asked and what came back, so "approved but nothing happened" is visible in the dialog rather than guessed at.

✅ How to tell it works

ProbeExpected
curl -s -o /dev/null -w '%{http_code}\n' https://<label>.mrrc.vlsc.net/login200
Same against a name nobody registered404
curl -I https://<label>.mrrc.vlsc.net/login405 — normal: the login page only accepts GET

A wrong certificate is not a warning you click through: the hub verifies the upstream certificate on every request, so an instance presenting the wrong name answers 502 on the edge instead of quietly serving.

🪪 Callsign rules

The callsign becomes a DNS label, so portable and suffix forms such as BG1SB/P are rejected — register the identity, not the operation. The maintenance team verifies against the club registry before approving.

⚠️ Known limits

  • A new certificate needs an application restart. The TLS context is built at startup; a certificate that arrives afterwards is not served until the process restarts.
  • The tunnel client is pinned to the hub's frps version (0.71.0 at the time of writing). A newer client may fail the handshake.
  • Login rate limiting degrades behind the tunnel: every visitor arrives from loopback, so the limiter shares one bucket (5 failed attempts per 5 minutes). Documented and accepted; the fix is trusting X-Forwarded-For, which this product does not do yet.

📚 Where the details live