NEW Feature: Add optional Tailscale integration for secure remote access

[albertsole33]

Is your feature request related to a problem? Please describe.

NoJoin works well as a local deployment, but accessing it securely from another device currently requires users to configure networking, HTTPS certificates, reverse proxies, and Tailscale manually.

This is especially relevant when NoJoin runs on a home workstation with a GPU while the user attends meetings from another location or device.

Describe the solution you'd like

Add optional, first-class Tailscale support to NoJoin.

A possible implementation could:

• Detect whether Tailscale is installed and connected.
• Offer a guided setup for Tailscale Serve.
• Configure the NoJoin HTTPS service and WebSocket connections correctly.
• Display the resulting tailnet URL and connection status.
• Provide a QR code for opening NoJoin on a mobile device.
• Allow the integration to be enabled or disabled without modifying the core deployment.
• Keep audio, transcripts, models, and inference on the NoJoin host.
• Never enable Tailscale Funnel or public Internet exposure by default.

The UI or documentation should also explain that Tailscale Serve normally requires the accessing device to be connected to the same tailnet.

Describe alternatives you've considered

Manual Tailscale Serve configuration is possible, but it requires knowledge of Docker networking, TLS, reverse proxies, trusted origins, and WebSocket forwarding.

Traditional port forwarding was rejected because it exposes the service directly to the Internet.

VPNs and custom reverse proxies were also considered, but they create substantially more configuration and maintenance work.

Tailscale Funnel could support access from a browser-only device that cannot install Tailscale, but it introduces public Internet exposure. If supported at all, it should be explicitly opt-in and protected by strong application-level authentication.

Additional context

The primary use case is:

1. NoJoin runs locally on a private GPU workstation.
2. Processing and storage remain on that workstation.
3. The user connects remotely through a private Tailscale network.
4. NoJoin remains usable through a standard HTTPS browser interface.
5. No ports are opened on the home router.

This should be an optional integration and should not change the default local-only behavior.

[Valtora]

I am declining the integration itself. How the container is reached is operator infrastructure, and there are many valid answers, Tailscale, WireGuard, a VPN appliance, an existing reverse proxy, a corporate network. Supporting one of them means owning its auth model, CLI surface and upgrade cycle inside my release process, and shipping its client into images I keep deliberately minimal.

The underlying complaint is fair, and part of it is mine. What is Nojoin-specific is the reverse-proxy contract: which headers are trusted, how the trusted proxy range is configured, and how WebSocket upgrades must be forwarded. Leaving people to reverse-engineer that is a documentation gap.

So I propose converting this to a documentation task instead. I will document the proxy contract, and a Tailscale Serve recipe written against it would be a welcome contribution.

Relabelling accordingly. I will do a documentation pass shortly.