Discover MoveIt Pro Deployments on a Network

MoveIt Pro's discovery server lists the default deployment and named instances on a computer. The MoveIt Pro desktop app can save connections to multiple Runtimes on one or more computers and switch between them.

How discovery works

On a supported host, moveit_pro run starts a small instance discovery server on port 3204 unless you pass --no-discovery. It advertises that endpoint on the local network with DNS-SD and answers GET http://<host>:3204/instances with the default deployment and recorded named instances. Each entry includes its name, Runtime service ports, and whether its REST TLS service is running. This credential-free presence check supports Running and Not Running in the desktop app; it does not claim Runtime readiness.

The same port lets the desktop app retrieve the selected Runtime's public TLS certificate. The app uses the frontend key to confirm that the certificate belongs to the expected deployment before sharing the key with the Runtime. The discovery service never returns or exposes the frontend key.

Query a host directly to inspect its deployments:

curl http://<host>:3204/instances

Manage the server explicitly when needed:

moveit_pro discovery status
moveit_pro discovery up
moveit_pro discovery down

Pass --no-discovery to moveit_pro run to skip starting it.

Restrict discovery access

The instance list is unauthenticated and reveals deployment names, hostnames, service ports, running state, and protocol capabilities. The pairing response exposes only a public certificate and is authenticated before the desktop trusts it. Expose port 3204 only on trusted networks. DNS-SD advertisement is published through the Runtime computer's Avahi daemon. The MoveIt Pro host packages install the required Avahi command-line tools during normal package installation. Advertisement finds unsaved Runtime computers, while saved connections remain listed when discovery or multicast is unavailable. On firewalld-based systems (Fedora, RHEL), allow the required discovery endpoint and mDNS browsing with:

sudo firewall-cmd --permanent --add-port=3204/tcp
# Automatically find unsaved Runtime computers on the local network.
sudo firewall-cmd --permanent --add-service=mdns
sudo firewall-cmd --reload

Connecting from the desktop app

Start the desktop app and select a discovered Runtime, or select Add Connection and enter the Runtime computer's hostname or IP address. The app discovers advertised Runtime computers on the local network and queries the local computer and saved hosts on port 3204. A saved connection stays available without a status badge when discovery cannot reach it. When a saved frontend key is available, the app authenticates the Runtime certificate and may also show Not Ready from the authenticated /health response. The same authenticated readiness check runs when you select Connect.

A saved connection can also include an optional Alternate hostname or IP address. Select Add Alternate Address to show this field. It is useful when local discovery returns a hostname that does not work over your VPN, overlay network, or other remote route. You can instead use the remote hostname or IP address as the first address if that is the route you normally use. When both are configured, the app tries the first address before the alternate. Both must lead to the same Runtime.

Each saved connection includes its first address, optional alternate address, and service ports for one Runtime computer. HTTPS and the standard ports are selected by default. Only change the advanced Web bridge, video signaling, WebRTC media, and terminal ports for a nonstandard deployment. The default deployment uses WebRTC media port 3203 and terminal port 3205.

Enter the Runtime's active frontend key. Run moveit_pro frontend-key on the Runtime computer to display it. The desktop app stores the key in the operating system credential store and does not display it again. To replace the key, run moveit_pro configure --rotate-frontend-key, restart the Runtime, and update the saved connection. To delete the key without replacing it, edit the connection, select Delete beside Frontend key, then select Save Changes. This removes only the key stored with that saved connection; it does not revoke or rotate the Runtime's active frontend key.

When the desktop app and Runtime run under the same operating-system account, moveit_pro run registers the local Runtime through an owner-only local socket. The desktop app can then save that Runtime's key directly to that account's protected credential store. The key is never included in network discovery. Another operating-system account must enter the key explicitly; the shared frontend key is not a multi-user authorization mechanism.

The desktop app reserves loopback ports 61000–61031 for stable per-window origins and durable UI preferences. Named-instance port overrides must not use that range; move an existing override outside it before upgrading.

After connecting, open Settings from the top navigation bar and select Runtime Connections to return to the connection selector. If the active Runtime becomes unavailable, the desktop app keeps the interface open while it reconnects; select Choose Another Runtime to return to the selector instead. See Connect with the MoveIt Pro Desktop App for the complete workflow.