doubletake

AirPlay screen mirroring sender for Linux. Streams your desktop to an Apple TV using the AirPlay mirroring protocol.

Maintained fork

This is alchemy/doubletake, an independently maintained fork of omarroth/doubletake. Our main includes selected fixes beyond upstream; distribution packages listed below may still contain only upstream code. See fork maintenance and validation for included changes, known limitations, and release checks.

To build this fork, install the requirements below, then:

git clone https://github.com/alchemy/doubletake.git
cd doubletake
make all
./bin/doubletake

Record git rev-parse HEAD when reporting a problem. Check out that exact commit before rebuilding to reproduce the same source version.

Features

• Full AirPlay mirroring protocol (RTSP/HTTP + encrypted video stream)
• FairPlay SAP authentication (clean Go implementation)
• SRP-6a pairing with PIN and persistent credential storage
• Wayland (PipeWire/xdg-desktop-portal) and X11 screen capture
• Hyprland extend mode with a temporary virtual monitor per receiver
• H.264 encoding with NVENC, VA-API, OpenH264, and x264
• Capability-gated HEVC Main10/high-resolution encoding with NVENC or x265
• ChaCha20-Poly1305 stream encryption
• mDNS device discovery
• Daemon mode with multi-target streaming control (doubletake-ctl)
• In-process test receiver for hardware-free pairing and media-flow tests
• Automatic AirPlay screen/audio latency policy with an optional -target-latency-ms override
• KDE Plasma widget for quick access (see plasmoid/)

Extend your desktop (Hyprland)

./bin/doubletake -extend -target TV_IP
# Choose another desktop size:
./bin/doubletake -extend -extend-size 1280x720 -target TV_IP

Doubletake creates a temporary monitor named doubletake-…, placed automatically beside your existing monitors and selects it automatically using the Hyprland portal picker hook. Move windows onto it using your usual Hyprland workspace/window controls. Saved mirror selections are ignored and extend selections do not overwrite your saved mirror token.

The default desktop is 1920×1080 at scale 1, with the -fps refresh rate. It is scaled to the receiver's negotiated video canvas. This uses the existing AirPlay mirroring transport; the receiver needs no special extend capability. Audio still captures the computer's desktop audio, not only applications on the virtual monitor.

Daemon mode supports the same flags:

./bin/doubletake -daemonize -extend -extend-size 1920x1080
./bin/doubletake-ctl connect TV_IP

Each extended receiver gets an independent desktop. A single daemon can mix mirror and extend sessions; choose the mode when connecting:

./bin/doubletake-ctl -mode extend -extend-size 1280x720 connect TV_IP
./bin/doubletake-ctl -mode mirror connect OTHER_TV_IP

Socket clients send mode: "mirror" or mode: "extend" and optional extend_size: "1280x720" on the initial connect request. Omitted mode uses the daemon startup default, preserving compatibility with existing clients. Status reports mode and extend_size per stream. Disconnect and reconnect to change an existing session's mode; PIN/password submissions retain its original mode.

Detecting daemon features

doubletake-ctl status (socket request {"cmd":"status"}) includes:

"capabilities": {
  "session_modes": ["mirror", "extend"],
  "per_session_mode": true,
  "extend_backends": ["hyprland"]
}

These fields describe the running daemon's implemented features, regardless of idle/active state or reported connection errors. They do not probe the environment: Hyprland, its portal, and capture dependencies still need to be available. Clients should enable extend only when session_modes includes extend, and check per_session_mode before requesting modes on individual connections. A missing capabilities field means legacy/unknown support; do not infer extend support from a package name or from a newer binary installed while an older daemon is still running. Clients should ignore unknown fields and mode names.

Hyprland picker integration

On first use, extend mode installs hyprland-picker.sh under $XDG_DATA_HOME/doubletake (default ~/.local/share/doubletake) and appends a marked block to ~/.config/hypr/xdph.conf (or $XDG_CONFIG_HOME/hypr/xdph.conf). The existing picker remains the fallback, including custom preview pickers. The original configuration is backed up as xdph.conf.doubletake-backup.

That first installation restarts xdg-desktop-portal-hyprland, which interrupts other active screen shares. Subsequent connections leave the portal running. The wrapper remains installed after disconnect and uses the normal picker unless it consumes a one-shot extend marker. Markers expire after 30 seconds, require a live sender, and are removed after the portal request, including failed requests. Doubletake serializes its portal acquisitions across processes.

Limitation: Hyprland does not supply requester identity to custom pickers. Another application's simultaneous share request can consume the extend marker and receive the virtual display. Avoid starting other screen shares during extend connection startup. Ordinary sharing after startup uses the normal picker. Finish any active Waycast session before first installing this integration.

To uninstall the integration, stop sharing, remove only the block between # BEGIN doubletake extend picker and # END doubletake extend picker from xdph.conf, restart xdg-desktop-portal-hyprland, and remove the wrapper script. Preserve other edits rather than restoring an old backup over the current file.

Requirements: a running Hyprland session, hyprctl, and a working Wayland sharing portal/PipeWire setup. Other compositors and X11 extend are not implemented. -extend cannot be combined with -test or X11 window capture.

The monitor is removed on normal disconnect, cancellation, and handled setup errors; the virtual monitor is not saved in your monitor configuration. After a forced kill or process crash, a monitor may remain. Identify it with hyprctl monitors all, then remove only its exact name with hyprctl output remove doubletake-NAME.

Requirements

• Go 1.23+
• GStreamer 1.0 (with plugins-base, plugins-good, plugins-bad, plugins-ugly, libav)
• PulseAudio utilities (pactl; pulseaudio-utils on Ubuntu/Debian or the equivalent package on other distributions)
• PipeWire (Wayland) or X11 for screen capture

Ubuntu/Debian

sudo apt install libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev \
  gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-plugins-bad \
  gstreamer1.0-plugins-ugly gstreamer1.0-libav pulseaudio-utils

Arch Linux

sudo pacman -S gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad \
  gst-plugins-ugly gst-libav libpulse

The openh264 encoder requires the GStreamer openh264enc element, normally provided by the plugins-bad package. Check availability with gst-inspect-1.0 openh264enc.

You can also install this Alchemy fork from the AUR. Both packages install the forked version of doubletake, including Hyprland extend mode and per-connection mode selection:

• doubletake-alchemy — builds the fork's tagged release from source.
• doubletake-alchemy-bin — installs prebuilt binaries from the fork's GitHub release.

Choose one package. Both provide the doubletake and doubletake-ctl commands.

Receiver discovery

The daemon publishes receivers as soon as they resolve. When Avahi is running, it uses Avahi's D-Bus service and shared mDNS cache; otherwise it falls back to native mDNS without requiring an additional daemon. On Arch Linux, the optional avahi package supplies this service (avahi-daemon.service).

doubletake-ctl discover returns the current cache immediately and requests a background refresh. Repeated requests are coalesced, with at most one browse restart every five seconds. doubletake-ctl devices reads the cache without requesting a refresh. Discovery continues in the background, processes service removals, and expires receivers not observed for thirty seconds.

Receiver timing compatibility

When a receiver selected for PTP omits timingPeerInfo or its ClockID, doubletake tears down the partial session and retries once with NTP on a fresh connection. It repeats authentication and FairPlay negotiation before creating new media streams. Present but invalid clock identities still fail; a valid identity without private clock headers retains the existing PTP fallback.

Validated on LG OLED55B9PLA, sourceVersion 377.25.06, firmware 05.50.00: forced NTP produced a responsive desktop, and automatic PTP-to-NTP recovery completed SETUP and streamed over 5,000 frames with user-confirmed responsive video. TV audio remains unresolved: audio packets were sent, but the user heard no TV audio in either run, including a brief tone test.

Tested Devices

These are devices that have been tested with doubletake. If there are devices not listed here that you have confirmed working or non-functional, please open an issue.

• AppleTV3,2 (2013 3rd generation)
• AppleTV11,1 (4K, 2021 2nd gen)
• AppleTV14,1 (4K, 2022 3rd gen) + Homepod (1st gen)
• AppleTV14,1 (4K, 2022 3rd gen)
• Mac17,2 (MacBook Pro, M5 14")
• Mac16,10 (Mac mini, M4)
• Roku Streaming Stick 4K (3820R2)
• Samsung TV TU8300 Series 4K UHD
• Hisense 55A6QU
• Xiaomi 4K HDR TV (AFTBR92D74) (currently non-functional, see #4)

Build

make

This builds the three binaries into bin/:

• bin/doubletake
• bin/doubletake-ctl
• bin/doubletake-test-receiver

Install

Install binaries and man pages (default prefix: /usr/local):

sudo make install

Use a custom prefix if needed:

make install PREFIX=$HOME/.local

Uninstall:

sudo make uninstall

Run tests:

make test

Optional AAC-ELD support

Doubletake selects screen audio from the receiver's advertised supportedFormats.screenStream mask, preferring its built-in ALAC encoder when available. AAC-ELD is enabled explicitly because it depends on the system libfdk-aac development files and cgo:

CGO_ENABLED=1 go build -tags fdk_aac -o bin/doubletake ./cmd/doubletake

Install the package that provides the fdk-aac pkg-config file and headers for your distribution before running that command. A default build reports a clear error if advertised capabilities select AAC-ELD. A nonzero screen-audio mask which advertises neither ALAC nor AAC-ELD is also rejected instead of silently sending an unadvertised format. Use -no-audio to keep testing pairing, timing, and video when the advertised audio format is unavailable.

Firewall

doubletake reserves three consecutive UDP ports for timing and audio traffic. Receiver-initiated NTP sessions probe the timing port during SETUP; PTP and sender-initiated NTP sessions do not require that inbound timing traffic. The event and video data channels are outbound TCP connections from doubletake to ports returned by the receiver, so they do not require inbound firewall rules. NTP and PTP use the same presentation policy; the timing protocol only changes how timestamps are represented. In automatic mode, an ordinary connection uses the AirPlay defaults observed in the checked-in sender artifacts: 75 ms for video and 85 ms for screen audio. When the automatic high-resolution HEVC preflight measures a longer local capture-to-access-unit path, doubletake adds the same scheduling margin to both values. This keeps Apple's 10 ms relationship while ensuring video reaches the receiver before its presentation deadline.

By default the OS assigns ephemeral ports. Use -port-range MIN-MAX to confine the UDP ports to a small window you can open in your firewall (needs at least 3 ports):

doubletake -target 192.168.1.77 -port-range 60000-60010

Daemon mode uses the same range for every managed stream. Reserve at least three available ports per receiver that may stream simultaneously.

Then with UFW:

sudo ufw allow from any proto udp to any port 60000:60010

For nftables/firewalld, add an equivalent rule allowing inbound UDP from the receiver's address on the chosen range.

Password-protected receivers

If the receiver has Require Password enabled (on an Apple TV: Settings → AirPlay and HomeKit), it challenges the mirroring SETUP request with HTTP Digest auth and mirroring fails with HTTP 401 until doubletake answers it. Pass the password with -code:

DOUBLETAKE_CODE='...' doubletake -target 192.168.1.77

-code carries whatever the receiver is asking for — the onscreen pairing PIN during -pair, or the fixed password when "Require Password" is enabled. $DOUBLETAKE_CODE is preferred over the flag: a command line is visible to other users via ps and lands in shell history. The environment variable takes precedence when both are set.

Pairing and Digest authentication remain separate wire protocols, but doubletake deliberately uses one credential flow for both: a PIN/password entered during pairing is retained for later Digest challenges and reconnects. A receiver may consume that value during pairing, Digest auth, both, or neither. Supplying -code does not by itself trigger re-pairing.

When the capability policy selects first-party CoreUtils/HAP pairing, a configured fixed password is reserved for Digest authentication and is never reused as an SRP pairing PIN, including with -pair. A legacy/HKP pairing flow may consume the same entered value during both SRP and Digest when its protocol requires it.

The CLI and Plasma applet prompt once after inspecting the receiver's security mode. In the Plasma applet, an on-screen PIN uses a visible four-digit field, while a configured password uses an unrestricted masked field. Doubletake does not request or claim that a PIN is visible in password mode. The daemon exposes the distinction while retaining doubletake-ctl pin <PIN-or-password> for command compatibility when exactly one receiver is waiting. With concurrent prompts, submit each value with doubletake-ctl connect TARGET PIN-or-password.

One thing that makes this confusing to diagnose: "Require Password" is a fixed password you set, not a rotating onscreen code. Nothing appears on the TV during -pair, and the prompt is asking for that configured password.

Run with -debug to see the challenge and whether the retry was accepted.

Hardware-free test receiver

doubletake-test-receiver is an in-repository AirPlay receiver for exercising pairing, encrypted RTSP, SETUP ordering, timing, event channels, and sustained audio/video traffic without an Apple TV or third-party receiver. It is a diagnostic sink, not a media player or a receiver-compatibility substitute.

Runtime selection is capability-driven. The selected device's mDNS features, fex, srcvers, protovers, and flags remain available after discovery; explicit /info fields take precedence and the advertisement fills omissions. Pairing probes and the encryption state that actually negotiates then determine the wire format. See Receiver compatibility for the artifact cross-checks, explicitly labeled empirical exceptions, and end-to-end flow.

Display sizing is resolved after the receiver creates its media session rather than being frozen from the initial /info, which can omit displays. Doubletake preflights the capture source first; on Wayland this completes the interactive portal request and retains the authorized PipeWire source without starting the encoder. Control SETUP then requests ordinary receiver info with combinedGetInfoWithControlSetup (without a qualifier), and a returned info dictionary takes precedence over the pre-session snapshot. If it is omitted, doubletake makes one bounded /info refresh after the accepted control SETUP, or after the accepted audio SETUP on a negotiated media-first path.

The encoder uses the resolved nominal widthPixels/heightPixels mirroring canvas. widthPixelsMax/heightPixelsMax describe the receiver's upper decoding ceiling; they do not select the ordinary mirroring resolution. If display metadata remains unavailable, screen endpoints use the artifact-backed feature 28 default of 1920x1080, or 1280x720 when feature 28 is absent.

SETUP ordering is negotiated independently of the advertisement: every session starts with Apple's control-only form and makes one media-first transition only if that control shape is explicitly rejected. Feature 59 selects only the initial audio descriptor (streamConnections versus controlPort), with one alternate-shape retry after an explicit rejection. Encrypted HAP sessions keep FairPlay material in stream descriptors; plaintext/raw sessions use available legacy FairPlay roots on control and media SETUP.

The named profiles are receiver-side validation presets covering combinations observed on modern Apple, Roku, LG webOS, legacy Apple TV/UxPlay, and AirServer/Airtame implementations. They deliberately keep pairing, SETUP order, timing, FairPlay, and audio layout as separate compatibility axes. Profile name, advertised receiver name, model, and manufacturer do not select sender behavior; the sender uses advertised capabilities and the protocol that actually negotiates. The profile table describes fixtures; the Tested Devices list above remains the record of hardware validation.

The receiver parses the outer AirPlay video framing and counts video and audio traffic. Its AppleTV3 and UxPlay profiles also authenticate the FairPlay key, decrypt legacy AES-CTR video, and validate the resulting AVCC/NAL structure. It does not decode or display video or play audio; other encrypted media paths remain transport-only checks.

Start a Roku-compatible receiver whose configured fixed password is required by both SRP and Digest authentication. This mode does not display a PIN:

DOUBLETAKE_RECEIVER_CODE='aaaaaaaa' \
  bin/doubletake-test-receiver -profile roku -auth combined -debug

Then run the real sender against it from another terminal:

DOUBLETAKE_CODE='aaaaaaaa' \
  bin/doubletake -target 127.0.0.1 -port 7000 -pair -test

The receiver profiles are coherent validation combinations:

Profile	Capability/protocol combination exercised
modern	Omits pre-session display metadata and returns a 1920x1080 nominal canvas with a 3840x2160 ceiling through combined control SETUP info; also exercises CoreUtils HAP, encrypted control, features 41/59, PTP, streamConnections, ALAC, and descriptor-only FairPlay keys
roku	Rejects the initial control SETUP and exercises the one media-first fallback; third-party/HKP pairing, the 377.40.x NTP exception, ALAC, and one alternate audio-descriptor retry under authenticated HAP
lg	Models OLED55B9PLA (377.25.06): accepts control SETUP but omits PTP ClockID despite feature 41; retries on a fresh authenticated NTP session, with receiver-initiated timing, controlPort + shk, and ALAC
legacy-ptp	Synthetic legacy HAP receiver: media-first SETUP, valid PTP identity without private timestamp headers (local clock anchor), controlPort + shk, and ALAC
appletv3	Rejects the initial control SETUP and exercises the one media-first fallback; raw pairing with feature 27, receiver-initiated NTP, original raw FairPlay derivation, ALAC, and plaintext root FairPlay keys
uxplay	Rejects the initial control SETUP and exercises the one media-first fallback; raw pairing without feature 27, X-Apple-PD FairPlay-secret mixing, NTP, ALAC, plaintext FairPlay roots, and omitted optional eventPort
airserver (airtame alias)	Accepts the initial control SETUP; a rejected HAP probe followed by raw fallback, plaintext NTP, feature-59 streamConnections followed by one accepted controlPort retry, advertised AAC-ELD, and plaintext root FairPlay keys

Authentication modes all use the single -code value (or $DOUBLETAKE_RECEIVER_CODE):

Mode	Pair setup	RTSP Digest
none	transient	no
pin	code required; advertises an on-screen PIN	no
password	fixed code required	no
digest	transient	code required
combined	fixed password required; no on-screen PIN	same password required

Use -listen 127.0.0.1:0 to choose an ephemeral port, and -stats-interval 1s to print live counters. See doubletake-test-receiver(1) for all options.

Usage

# Discover Apple TVs on the network and stream
doubletake

# Disable audio for video-only mirroring
doubletake -no-audio

# Connect to a specific Apple TV
doubletake -target 192.168.1.77

# First-time pairing with PIN (saves credentials for reuse)
doubletake -target 192.168.1.77 -pair

# Use saved credentials
doubletake -target 192.168.1.77 -creds airplay-credentials.json

# Adjust stream settings (bitrate 0 = auto)
doubletake -target 192.168.1.77 -fps 30 -bitrate 0

# Force a lower bitrate on weaker Wi-Fi
doubletake -target 192.168.1.77 -bitrate 4500

# Override the automatic audio/video playout latencies with one joint value
doubletake -target 192.168.1.77 -target-latency-ms 100

# Hardware encoding
doubletake -target 192.168.1.77 -hwaccel nvenc   # NVIDIA
doubletake -target 192.168.1.77 -hwaccel vaapi   # Intel/AMD

# OpenH264 software encoding
doubletake -target 192.168.1.77 -hwaccel openh264

# Automatic capability-gated HEVC Main10/high-resolution selection is the default
doubletake -target 192.168.1.77

# Force one codec (HEVC uses the receiver's maximum canvas)
doubletake -target 192.168.1.77 -video-codec hevc
doubletake -target 192.168.1.77 -video-codec h264

# Debug mode (verbose protocol logging)
doubletake -target 192.168.1.77 -debug

# Run daemon mode and control from a second shell
doubletake -daemonize -port-range 60000-60010
doubletake-ctl status
doubletake-ctl connect 192.168.1.77
doubletake-ctl connect 192.168.1.133
doubletake-ctl disconnect 192.168.1.77
doubletake-ctl disconnect

Flags

Flag	Default	Description
-target		Apple TV IP (skip mDNS discovery)
-port	7000	AirPlay port
-code		Pairing PIN shown on the receiver, or its configured password when "Require Password" is enabled (see Password-protected receivers); prefer $DOUBLETAKE_CODE
-port-range		Local UDP port range for timing/audio (at least 3 ports)
-cred-backend	file	Credential backend (file or keyring)
-creds	~/.config/doubletake/credentials.json	Credentials file path
-pair	false	Force new pairing
-fps	30	Frames per second
-bitrate	0	Video bitrate in kbps (0 = auto)
-target-latency-ms	0	Joint audio/video playout latency override in milliseconds (0 = automatic AirPlay policy with separate defaults)
-hwaccel	auto	Encoder preference: auto, nvenc, vaapi, openh264, none
-video-codec	auto	Screen codec: capability-driven auto, forced h264, or forced hevc
-no-encrypt	false	Disable RTSP header encryption (debugging only)
-direct-key	false	Use shk/shiv directly without SHA-512 derivation
-no-audio	false	Disable audio streaming
-test	false	Use synthetic video source
-daemonize	false	Run as background daemon with Unix socket control interface
-socket	$XDG_RUNTIME_DIR/doubletake.sock	Daemon control socket path
-debug	false	Verbose debug logging

Only -hwaccel auto tries fallback encoders, in the order vulkanh264enc, nvh264enc, vah264enc, openh264enc, then x264enc. Explicit selections fail if their required GStreamer encoder is unavailable; none forces x264 for H.264 or x265 for explicitly requested HEVC. In the normal -video-codec auto path, HEVC is selected only when final session information advertises feature 42 and a maximum above 1920x1080, and the sender has the complete nvh265enc Main10/timestamp pipeline. Otherwise it uses H.264 at the nominal canvas. Explicit -video-codec hevc remains available with nvh265enc or x265enc; use -hwaccel none to force the software path. Preflight verifies the automatic path with a sustained, timestamped 4K P010 sample through the same HEVC parser and RTP/ONVIF framing chain before receiver SETUP begins. It measures the source-PTS-to-access-unit p95 and reserves a bounded delivery margin; an unusable or excessively delayed hardware path falls back to H.264. The result is cached per requested frame rate.

Main10 alone does not turn an SDR X11 or portal capture into HDR: doubletake preserves encoder-provided HDR SEI but does not invent PQ/HLG mastering metadata or relabel SDR colors as HDR.

Daemon Control (doubletake-ctl)

doubletake-ctl status
doubletake-ctl discover
doubletake-ctl devices
doubletake-ctl connect [target] [PIN-or-password]
doubletake-ctl pin <PIN-or-password>
doubletake-ctl disconnect [target]
doubletake-ctl mute [target]
doubletake-ctl unmute [target]

• disconnect without a target stops all active streams.
• disconnect <target> stops only that receiver.
• mute/unmute can operate globally or per target. They silence/resume outgoing audio without changing the TV volume. Audio already buffered by the receiver may finish playing before mute takes effect.
• pin retains its historical command name, but submits whichever credential the daemon requests: an on-screen PIN or a configured password. It is targetless and therefore requires exactly one waiting receiver; use connect <target> <PIN-or-password> when multiple receivers are waiting.

Daemon streams are grouped by codec and the normalized even-sized canvas resolved during each receiver's SETUP. Targets with the same key share one capture and encoder; targets with a different codec or canvas use independent encoders, so connection order does not determine another receiver's size. For example, a receiver reporting a 1920x1080 canvas and a 3840x2160 maximum joins the 3840x2160 HEVC group when automatic HEVC is available, or the 1920x1080 H.264 group when it is unavailable or H.264 is forced. Fan-out uses a bounded queue per target within each group. Timestamped video permits up to 250 ms of nominal frame duration to absorb short encoder bursts; this is a capacity limit, not an added playback delay. A stalled target is detached when its queue fills, without blocking peers that share the encoder. Other canvas groups continue independently as well.

Disclaimer

The majority of code for this project was written by LLMs. I've read through the code to make sure there's nothing obviously stupid, but if you're in a production or security-sensitive environment and need to use AirPlay (for whatever reason), do not use this project.

Since I assume most of the code for this project was trained from UxPlay and similar projects, I've provided this project under a similar license. Most of the reverse engineering work has already been done by many other people and this project would not be possible without them.

License

This project is licensed under the GNU Lesser General Public License v3.0 or later (LGPL-3.0-or-later). See the LICENSE file for the LGPL terms and COPYING.GPL for the incorporated GPLv3 terms.

Releases v0.3.2 and earlier were provided under the GNU General Public License v3.0 or later (GPL-3.0-or-later).

Prebuilt fork releases

Fork releases from v0.4.0-alchemy.2 publish doubletake-VERSION-linux-amd64.tar.gz and doubletake-VERSION-linux-arm64.tar.gz, each with a .sha256 checksum file. Each archive contains the three executables, manpages, documentation, licenses, and VERSION/REVISION files. Go is not needed to run them; GStreamer and the runtime requirements above are still required. The binaries use the default ALAC audio build, without optional FDK AAC-ELD. Arm64 is cross-compiled; this does not establish hardware capture compatibility on every arm64 system.

For maintainers, bash scripts/build-release.sh VERSION ARCH [OUTPUT_DIR] builds the same archive layout locally. Tag-triggered CI tests the source, builds both architectures, and publishes the archives and checksums.