How to Stream a Desktop with Moonlight & Sunshine

How to stream a desktop into Tempest over Moonlight — installing the component, pairing with a Sunshine host, the ports involved, and what the stream does and does not carry.

Moonlight is the fastest way to reach a machine you own. Instead of sending rectangles of pixels the way VNC does, the host encodes its screen with the same hardware encoder a game capture uses and sends H.264 or HEVC over UDP. Tempest speaks it as a connection type, so a paired machine opens as a tab next to your SSH sessions.

A Mac desktop streamed into a Tempest tab over Moonlight, running the TestUFO motion test at 60 fps

What this is, and what it is not

Tempest's Moonlight sessions are video and input only:

No audio. The stream negotiates an audio channel because the protocol requires one, and then discards it.
No gamepads. Controllers are not forwarded.
The desktop, not a game. Tempest launches the host's Desktop entry, so you get the whole machine rather than a single title.

If you want sound and a controller on the sofa, use the Moonlight client itself. If you want a fast remote desktop in the same window as the servers you administer, this is that.

What you need

On the host

Sunshine, running and reachable — or GeForce Experience on an older NVIDIA setup

On your machine

Tempest desktop on Windows (Intel/Arm), Linux (Intel/Arm), or macOS on Apple Silicon

Plan

Pro — Moonlight is a Pro connection type

Component

The Moonlight component, installed once (below)

Moonlight is not available in the mobile apps, and the Mac App Store build cannot load it: that sandbox forbids running downloaded native code, so the component manager is absent there entirely. Use the direct download from gotempest.app on macOS if you want it.

1. Install the component

The streaming engine ships separately from Tempest because it is GPL-3.0, and it is distributed as a signed .tpx package.

Open gotempest.app/download/moonlight — it redirects to the component's releases page.
Download the package for the machine Tempest runs on:
File
For
moonlight-<version>-win32-x64.tpx
Windows, Intel/AMD
moonlight-<version>-win32-arm64.tpx
Windows, Arm
moonlight-<version>-darwin-arm64.tpx
macOS, Apple Silicon
moonlight-<version>-linux-x64.tpx
Linux, Intel/AMD
moonlight-<version>-linux-arm64.tpx
Linux, Arm
In Tempest: Settings → Components → Install from file…, and pick the .tpx. Dragging the file onto that screen does the same thing.

The signature travels inside the package, so one file is all you need and there is nothing to verify by hand — Tempest checks it before anything runs, and refuses a package built for another version, another machine, or another app. A package you built yourself is unsigned and will not install.

The component runs as its own process with a bare environment: no vault, no keychain, no cloud session. A crash in it ends that stream, not your terminals.

2. Add the connection

+ → Moonlight.
Host — the address of the machine running Sunshine.
Port — 47989, Sunshine's plain-HTTP NVHTTP port, used for pairing. Change it only if you changed it there.
Codec — H.264 (default) or HEVC. HEVC costs the host less bandwidth at the same quality; H.264 is the safer choice on older hardware.
Save.

The stream itself runs at 1080p60, up to 20 Mbps. That is negotiated when the session starts and stays fixed for its lifetime — resizing the pane scales the picture rather than renegotiating the stream.

3. Pair with the host

The first connection prints a PIN:

Open Sunshine's web interface — https://<host>:47990.
Go to PIN and enter the number Tempest is showing.
The dialog closes on its own and the desktop appears.

Pairing is an exchange of certificates, not a password. Tempest generates a client identity on first connect and stores it on the saved host, encrypted the same way your SSH keys are — so every device you sync to is already paired, and nothing has to be typed twice.

To start over, use Forget pairing in the host's edit form. It is the same gesture as forgetting an SSH fingerprint: Tempest drops its identity and the next connection generates a new one. Sunshine keeps the old certificate until you remove it there too.

Ports

Sunshine's defaults, which the host's firewall must allow:

Port

Transport

Used for

47984

TCP

NVHTTP over HTTPS — server info, app list, launch

47989

TCP

NVHTTP plain HTTP — pairing

47990

TCP

Sunshine's own web interface (where you type the PIN)

48010

TCP + UDP

RTSP handshake

47998–48000, 48002

UDP

video, audio and control streams

For a host that is not on your network, forward these through a bastion rather than opening them to the internet — see SSH Port Forwarding.

Input

Mouse movement, buttons, scroll wheel, keyboard and clipboard text travel back up the stream. Keys are sent as physical key codes rather than characters, so a host set to Dvorak, AZERTY or a Chinese IME behaves the way it does when you sit in front of it.

Troubleshooting

"Moonlight needs an optional component." The component is not installed, or not installed for this machine's architecture. Install it as above.

"Needs updating for this version of Tempest." Tempest was updated and the component was not — a component has to match the app it plugs into. Download the current package and install it over the old one. "Built for a different platform" means you took the wrong file from the release; "Needs a newer version of Tempest" means the opposite, so update the app.

Pairing never completes. The PIN is only good while the dialog is open, and Sunshine's web interface must be the one on that same host. If the dialog closed, reconnect for a new PIN.

"Already running" / the host thinks it is busy. Sunshine allows one session at a time and holds the slot until it is released. Stop the session from Sunshine's web interface, or wait for it to time out, then reconnect.

A black window, or the stream never starts. The host has no Desktop entry, or its encoder cannot serve the requested codec. Try H.264 if you selected HEVC, and check Sunshine's own log.

Two Moonlight tabs at once work — each gets its own component process. The underlying streaming library keeps one connection per process, which is why they cannot share.