Reach Erebros from your phone (Tailscale)

Erebros listens on loopback only. The supported way to reach it from another device is a private network — Tailscale here; an SSH tunnel works the same way — plus the remote-access PIN. Never forward port 3300 to the internet.

1. Put both devices on one tailnet

Install Tailscale on the machine running Erebros and on your phone, and sign both into the same tailnet. Note the machine’s MagicDNS name — something like rog.tail1234.ts.net (tailscale status shows it).

2. Expose port 3300 on the tailnet

On the Erebros machine:

tailscale serve --bg 3300

This publishes http://rog.tail1234.ts.net:3300 to the tailnet only. Erebros keeps its loopback bind; Tailscale does the forwarding.

3. (Optional) Allow the host name

Settings → Security → Allowed hosts — add rog.tail1234.ts.net. You can skip this: an unknown host gets the unlock screen and a correct PIN adds it for you. The list is where you later review and remove devices.

4. Find the PIN

Settings → Security → Reveal on the machine, or cat ~/.erebros/access-pin. Erebros generated it at first boot and printed it once.

5. Open it on the phone

Browse to http://rog.tail1234.ts.net:3300. You get Enter access PIN; type it. The session lasts 30 days; the host is remembered in Allowed hosts. Add the page to the home screen for a full-screen app.

If pages load blank

In dev mode (npm run dev) Next refuses its assets from an unknown origin. Add the host to allowedDevOrigins in next.config.ts and restart. The production service (npm start) does not have this restriction.

Voice and mic

Browsers allow the microphone only on HTTPS or localhost. tailscale serve can terminate TLS for you (tailscale serve --bg --https=443 3300), which also makes the mic button appear on the phone.