How-To · 20 min

Connect Tailscale & reach Kaptain remotely

Kaptain never opens a port to the internet. Remote access means your own tailnet: a private network between your devices, run by Tailscale, with Kaptain listening only inside it.

How it works

Kaptain has exactly two network modes. Localhost only binds 127.0.0.1 — nothing off the machine can connect. Tailscale binds the machine's tailnet address (a 100.x.y.z IP) — only devices signed into your tailnet can even attempt to connect, and each still needs your access code. There is no third, internet-exposed mode.

One honest consequence: in Tailscale mode even the Kaptain machine itself connects through its tailnet address — a local script pointed at 127.0.0.1 is refused on purpose, so the mode never lies about its surface.

1 · Install Tailscale on both ends

1. Install Tailscale on the Kaptain machine (tailscale.com/download) and on the device that should reach it (phone: the Tailscale app from its store).
2. Sign both into the same tailnet (same Tailscale account).
3. Check the Kaptain machine: tailscale ip should print a 100.x.y.z address.

2 · Switch Kaptain's mode

1. Open Kaptain ▸ Settings ▸ Network Access (or pick Tailscale during setup).
2. Select Tailscale. Kaptain detects the installed Tailscale and its IP itself — you don't type addresses.
3. From now on the address is http://<tailnet-ip>:8810 — on every device, including this one.

3 · Pair the phone / another browser

1. On the remote device (inside the tailnet), open http://<tailnet-ip>:8810.
2. The pair screen asks for this Kaptain's access code — the chynj_… code you saved from the setup done screen. Paste it and press Connect — you're in.
3. The Android app pairs the same way: server address + access code.

Sessions are per-device and per-address, and they are bound to the current code — if the access code is ever rotated (for example by device re-registration), every device simply re-pairs once.

4 · Optional: the device allowlist

Settings ▸ Network Access can additionally restrict connections to tailnet devices you tick — identity confirmed by Tailscale itself, not by IP guessing. Changes are staged: nothing applies until you press Save changes and confirm the summary popup, and a failed save keeps your selection so you can retry. Your own machine is always allowed — you cannot lock yourself out.

5 · Verify

• Phone browser (or app) loads the chat and shows your sessions — you're in.
• Settings ▸ Network Access shows the active mode and, in the Access log, who reached this Kaptain — IP, path, status, and whether the request was authenticated. A burst of 401 · unauth rows from one IP is just an unpaired browser tab polling; pair it and they stop.

If it goes wrong

• Page never loads remotely — both devices really on the same tailnet? tailscale status on the Kaptain machine should list the remote device.
• Code rejected — you're pasting an old code after a rotation (re-registering the device mints a fresh one). Run kaptain device register on the Kaptain machine to get a new code, then pair with that.
• Worked locally before, "refused" now — that's Tailscale mode refusing 127.0.0.1 by design; use the tailnet address everywhere.
• Want a trusted HTTPS URL — see Enable HTTPS over Tailscale.

Agent-readable version: index.md · Every claim on this page was exercised on a real install before being written. Something missing that cost you time? That is a documentation bug — tell us.