Tailscale and HTTPS

Mandala has no login screen yet, so it must only be reachable by your own devices. Tailscale gives every device a private network address and a name, and can serve Mandala over HTTPS with a real certificate.

Serve Mandala on your tailnet

On the Mandala machine:

sudo tailscale serve --bg --https=443 http://127.0.0.1:8787
tailscale serve status

Mandala is now at https://<machine>.<tailnet>.ts.net for devices on your tailnet. Enable HTTPS certificates for your tailnet in the Tailscale admin console if asked.

Use another port if 443 is taken: --https=8445 gives https://<machine>.<tailnet>.ts.net:8445.

Why HTTPS matters

• The installable app and notifications need a secure origin.
• Passkeys and security keys are bound to the site name (by default your tailnet's name, tail1234.ts.net; MANDALA_RP_ID sets another). Keep the same name: changing it makes registered passkeys unusable here.
• Microphone access for voice needs a secure origin.

On each device

Install Tailscale and log in with the same account. On the iPhone, keep Tailscale connected (On Demand helps) for the app and Apple Health pushes to reach your home.

Never

• Do not use tailscale funnel: it publishes the service to the internet.
• Do not open Mandala's port on your router or firewall.

Coming soon — reaching your home without Tailscale through the device mesh, and an optional public address on your own domain once Mandala is hardened for the public internet.