Remote access

Out of the box, Pantry Raider is reachable only on your own network. That is the right default for a kitchen: nothing is exposed to the internet, and there is nothing to secure beyond your own front door.

Remote access is for the times you want the pantry with you. Standing in the cereal aisle wondering whether you already have two boxes, adding to the shopping list on the drive home, checking a timer from the yard. Turning it on gives your kitchen a web address you can open from anywhere, without opening a port on your router.

Remote access is still experimental. It works, and it is in daily use, but expect the occasional rough edge and do not make it the only way into your kitchen. See Feature maturity for how the rest of the app is rated.

The two ways in

Open Settings, Forager and find the Remote access panel. The Mode row offers three choices.

Off is the default. Nothing leaves your network.

Forager is the built-in option and the one this page is mostly about. Your kitchen gets an address like https://your-kitchen.forager.pantryraider.app, served over HTTPS, with no router configuration at all.

Cloudflare Tunnel is for people who already run their own Cloudflare Tunnel and would rather keep everything under their own account. Paste your tunnel token in the field below the radio. If you go this route, running cloudflared yourself alongside the stack and pointing it at port 9284 is the most dependable setup, and it works the same way any other self-hosted service does behind Cloudflare.

A reverse proxy you run yourself (Caddy, nginx, Traefik, Pangolin) is a fourth path that does not involve this panel at all. See the HTTPS section of Platforms and deployment for that.

Whichever path you choose, a kitchen reached from outside your home network needs a password, and signing in from outside needs two-factor as well. Turn on two-factor in Settings, Security from a device at home, then set the password. A kitchen with no password does not answer through a proxy or tunnel: one upgraded to 0.21 keeps answering for 14 days with a banner showing the date it stops, and after that it refuses. If you can only reach it from outside, the refusal page asks for the setup code from the kitchen's log, which lets you set a password and turn on two-factor from there. While remote access is on, the password cannot be turned off or cleared.

What a Forager plan includes

Forager is the optional hosted companion to Pantry Raider. You never need it: the app is complete without an account, and community recipes are free. What a paid plan adds is remote access and a pool of AI tokens so you do not have to bring your own provider key.

• Forager Free. An account, community recipes (browse, download, and share what you make), and a 30 day trial of everything below. One trial per install.
• Cloud Basic. Remote access plus a small monthly AI allowance. This is the one to pick if you already have your own Gemini, OpenAI, Anthropic, or Ollama setup and only want to get at your kitchen from outside.
• Premium. Remote access plus the full monthly AI allowance, which covers grocery photo scanning, receipt scanning, barcode enrichment, and shelf-life estimates without ever adding a provider key. Premium also unlocks backups pushed to Forager's own storage.

Forager's AI reads what you scan. It does not write recipes, recipe ideas, or nutrition estimates, and it does not read recipes from a photo, a PDF, or a web page. Those buttons stay hidden while Forager is your AI provider. To use them, add your own Gemini, OpenAI, Anthropic, or Ollama provider under Settings, Scanning & AI; you can keep Forager for remote access either way.

Current prices are on the Forager pricing page.

Subscribing

1. In the app, open Settings, Forager. If you have no account yet, use Create an account; it opens the Forager signup page.
2. Sign up. Every new account starts with a 30 day trial, so you can try remote access before paying for anything.
3. Sign in from the same Forager pane to link this kitchen. The link is per-device: a satellite or a second install links separately.
4. When you are ready to keep it, open Plan and billing on your Forager account page and pick a plan. The same page has Manage or cancel subscription whenever you want to change your mind.

Turning remote access on

Before the button will work, the app asks for two things, and both are worth having anyway:

• A password on this device. Remote access without a password would put your pantry on the open web. Set one under Settings, Security.
• A second factor. Either two-factor authentication on this device or on your Forager account. Signing in from outside your house always asks for a second factor, so this is not optional.

Then:

1. Set Mode to Forager.
2. Type the name you want in the Web address field. The app checks it as you type and suggests a free one if the name is taken.
3. Press Turn on remote access.

The panel then shows your address with a copy button. Give it a minute on the first run: the certificate is issued on demand, and the panel says whether the device has connected yet.

To change the address later, turn remote access off and back on with the new name. To stop entirely, press Turn off remote access or set Mode back to Off.

What actually happens

Your device makes an outbound WireGuard connection to Forager's server and keeps it open. Requests to your address arrive at that server and travel back down the tunnel to your kitchen. Nothing listens on your router, and nothing about your network needs to change.

Two details worth knowing:

• The connection is outbound only and carries traffic for your kitchen alone. It is not a full VPN: nothing else on your network is routed through it, and Forager cannot reach anything but the app.
• HTTPS terminates at Forager's server, which then relays to your kitchen over the encrypted tunnel. That is how the certificate can be issued for you. Privacy covers what that means in full.

A Raspberry Pi appliance runs the tunnel on the device itself, outside the app. A server runs it inside the Pantry Raider container, which is why a server needs a little extra setup, below.

Servers: one extra step

On a plain Docker server, the tunnel runs inside the Pantry Raider container, and Linux only lets a container do that when Docker grants it three extra things. A default install is not given them, because most kitchens never leave the LAN and there is no reason to hand every install privileges it will not use.

When you want remote access, add the override file that grants them:

docker compose -f docker-compose.yml -f docker-compose.forager.yml up -d

Keep your usual profiles on the same command, for example:

docker compose -f docker-compose.yml -f docker-compose.forager.yml \
  --profile with-grocy up -d

That is the whole change. Without the override, the Remote access panel says plainly that it is unavailable on this host and everything else works exactly as before. Your host also needs the kernel's WireGuard support, which every current Linux has, Unraid included.

A Raspberry Pi appliance needs none of this.

Going back a version

Worth saying here because it comes up when an update misbehaves: updates only move forward. Settings and database changes are applied on the way up and are not undone by installing an older build, so pinning an older tag on its own can leave the app looking at data it does not understand.

A real rollback is two things together: pin the older version, and restore the backup you took while you were on it. Take a backup before every update and that stays a two-minute job.

On a device with a Stream Deck, going back to a version before 0.21 needs one more step: open the Stream Deck settings and click Save Stream Deck settings once. From 0.21 the deck reaches Home Assistant through Pantry Raider, which older versions cannot do, and saving there gives it the settings the older version expects. The Home Assistant integration notices the older version by itself and hands it the kind of token it needs.

When something is not working

• "Connect this device to Forager first." Sign in on the Forager pane before turning remote access on.
• "Remote access is part of a Forager plan." Your trial has ended or the account has no plan. Add one from your Forager account page.
• The panel says remote access is unavailable on this host. On a server, add the override file above. On anything else, the host is missing WireGuard support.
• The address resolves but the page never loads. The panel reports whether the device has connected. If it is still waiting, check that the machine can reach the internet outbound.
• Your address is taken. Pick the suggestion the field offers, or type another name.

Home Assistant sensors and other headless clients should keep calling your kitchen at its LAN address, not the public one. See Platforms and deployment.