# Connect Tailscale & reach Kaptain remotely

Kaptain never opens a port to the internet. Remote access = your own tailnet (Tailscale), with Kaptain listening only inside it.

## How it works
Two modes only. Local only: binds 127.0.0.1, nothing off the machine connects. Tailscale: binds the machine's tailnet address (100.x.y.z); only devices in YOUR tailnet can attempt, and each still needs the access code. In Tailscale mode even the Kaptain machine itself uses the tailnet address — 127.0.0.1 is refused on purpose.

## 1. Install Tailscale on both ends
1. Install on the Kaptain machine and on the remote device (tailscale.com/download; phone app from its store).
2. Sign both into the SAME tailnet.
3. `tailscale ip` on the Kaptain machine prints a 100.x.y.z address.

## 2. Switch Kaptain's mode
Settings > Network Access > select Tailscale (or during setup). Kaptain detects the IP itself. Address becomes http://<tailnet-ip>:8810 on every device.

## 3. Pair the phone / another browser
Open http://<tailnet-ip>:8810 on the remote device; the pair screen asks for the access code — the chynj_... code you saved from the setup done screen. MFA (if enabled) asks its 6-digit code only at pairing. Android app: server address + access code. Sessions bind to the CURRENT code — after a rotation every device re-pairs once.

## 4. Optional: device allowlist
Settings > Network Access: restrict to tailnet devices you tick (identity confirmed by Tailscale). Changes are STAGED — apply only on Save changes + confirm; failed saves keep your selection. Your own machine is always allowed.

## 5. Verify
Phone loads chat + sessions. The Access log (Settings > Network Access) shows who reached this Kaptain: IP, path, status, auth. A burst of `401 unauth` from one IP = an unpaired tab polling; pair it and it stops.

## If it goes wrong
- Never loads remotely: `tailscale status` must list the remote device.
- Code rejected: stale code after rotation — run `kaptain device register` on the Kaptain machine to mint a fresh code, then pair with that.
- "Refused" locally in Tailscale mode: by design; use the tailnet address.
- Trusted HTTPS URL: https://chynj.ca/kaptain/docs/tailscale-https/