Skip to content

private-remote-access.md

Latest commit

 

History

History
81 lines (64 loc) · 3.68 KB

private-remote-access.md

File metadata and controls

81 lines (64 loc) · 3.68 KB
Raw

Private remote access

Host setup

  1. Install Tailscale on the HelioSlate host and sign in as the household owner.
  2. Open HelioSlate Household Access.
  3. Complete the private Tailscale Serve setup shown there. The dashboard stays private at https://<computer-name>.<tailnet>.ts.net and forwards only to the loopback portal on port 8766.
  4. Select Enable household website. HelioSlate starts its instruction-only helper on loopback port 8767 and asks Tailscale Funnel to expose it on public HTTPS port 8443.
  5. If Tailscale opens a consent page, enable Funnel for this device, return to HelioSlate, and select Enable household website again.
  6. Confirm that Household Access shows the computer-specific invitation URL: https://<computer-name>.<tailnet>.ts.net:8443.

Funnel is public, but only the onboarding helper is routed through it. The private dashboard and solar APIs are not part of the helper application. No router port forwarding is required.

Choose invitation delivery

For the recommended no-credential path, open the host in Tailscale Machines, select Share, choose Copy invite link, and paste that link beside the intended recipient in HelioSlate. Create a fresh single-use share for each person.

For automatic link creation:

  1. In the Tailscale admin console, open Settings -> Keys.
  2. Under API access tokens, select Generate access token.
  3. Choose an expiration from 1-90 days and name it HelioSlate invitation automation.
  4. Copy the token into Household Access -> Secure onboarding setup and select Enable automatic invites.

Tailscale currently rejects machine-share creation from trust-credential OAuth tokens, even when Device Invites -> Write is selected. That OAuth setup can still discover devices, but it cannot create a share. A user-owned API access token grants broader access and expires, so HelioSlate keeps it in Windows Credential Manager and clearly requests replacement when needed.

Invite a viewer

  1. Enter the expected email under Add a household viewer.
  2. Paste the single-use Tailscale share link unless automatic invitations are enabled.
  3. Select Create secure invitation.
  4. Choose Gmail, Outlook, Yahoo Mail, the default mail app, or copy the message. HelioSlate never requests an email password and never sends automatically.
  5. Review the populated message and press Send.
  6. The recipient opens the public helper, installs Tailscale, signs in with their own account, skips Tailscale's optional second-device introduction, and returns to the helper.
  7. They select Accept private connection again, accept the shared host, and then select Open private dashboard.
  8. Their dashboard remains at Waiting for owner approval with no telemetry.
  9. On the host, compare their authenticated email with the invitation and select Approve read-only or Deny.

Revoke access

  1. Select Revoke beside the person in HelioSlate Household Access.
  2. Revoke the machine share from the Tailscale Machines page.

HelioSlate revocation blocks the next API request. Removing the Tailscale share also removes private network reachability.

Disable the public helper

Use Disable household website in Household Access. HelioSlate removes the port 8443 Funnel route but leaves the private dashboard's Serve route intact. Previously sent helper links stop loading; approved private viewers keep their existing dashboard access.

Recovery

The owner identity is held in %LOCALAPPDATA%\HelioSlate\access.db. HelioSlate will not silently replace it when another account signs into Tailscale. Owner recovery requires access to the Windows host and an explicit, audited reset.