Reaching it from outside

Reaching it from outside

The board is safer to expose than an Argus, because there is no shell behind it. It is still not something to put on the open internet, and there is a second reason that catches people out: the links on the tiles have to work from wherever you are reading the board. A tile sends you to reach:, and if that is a LAN address then a board reached over the internet is a board full of dead links. Fixing the board's own reachability without fixing the machines' gets you one page and no way through it.

Which is why a VPN is the right shape here rather than a public URL — it makes the board and every machine on it reachable by the same names, from anywhere.

HTTPS, if you have a certificate

Both take the same two keys, and neither requires them:

tls_cert: /path/to/fullchain.pem
tls_key:  /path/to/privkey.pem

The printed link and the QR code change to https:// with them, so what you scan matches what the port speaks. One without the other is refused at startup — it would serve plain HTTP while looking configured, which is the worst of the three states.

It is never required, on purpose. On a LAN the address is a hostname or a private IP, and no public CA will sign either; so "just use HTTPS" means a self-signed certificate the browser argues about on every device, or your own CA installed on each of them, or a public DNS name pointing at a machine that has none. That turns a thirty-second setup into a certificate project, and the people who most need this are the ones who would give up.

What you give up without it is real and worth knowing: no installable PWA, no browser notifications, no in-app camera, and the clipboard falls back to an older API. What you mostly do not give up is confidentiality, if you are already behind a VPN — the traffic is encrypted on the wire either way. The exception is the token, which travels in the address once; on a shared LAN segment that is the thing worth encrypting.

Tailscale — the one to pick, and the one this pairs with best:

# on the machine running the board
tailscale serve --bg 8070          # https://<board>.<tailnet>.ts.net → your board

Then in the config, give each machine its MagicDNS name as reach, so a tile sends you somewhere that resolves from your phone as well as from the board:

machines:
  - name: hetzner
    url: http://127.0.0.1:8090            # where this board asks, over loopback
    reach: https://hetzner.tailnet.ts.net # where a browser should go, from anywhere
    token: …

serve puts a real certificate in front — a genuine one, for a *.ts.net name, with nothing to install on any device — which is also what makes the board installable as an app and unlocks the clipboard API.

If you would rather not: Chrome will treat a plain-http origin as secure if you list it in chrome://flags/#unsafely-treat-insecure-origin-as-secure, and then it offers the install too. That is a per-browser decision you make deliberately, which is the right shape for it.

The service worker behind that is network first, always. The cache is a fallback and nothing else — the board opens instantly instead of waiting for a LAN round trip, and it never answers for /api, because the entire content of this page is which machine wants you now and a stale answer to that is worse than none. Nothing is exposed to the internet: only devices on your tailnet can reach it. tailscale funnel does expose it publicly — don't. Not for the board, and certainly not for an Argus, which is a shell.

An SSH tunnel — nothing to install anywhere, and enough for one sitting:

ssh -N -L 8070:127.0.0.1:8070 you@board
# then open http://127.0.0.1:8070

The tiles' links will point at addresses your laptop cannot resolve unless you forward those too, one -L per machine. Fine for a look, tiring as a habit.

WireGuard, Cloudflare Tunnel, Teleport — all work, and none of them needs anything from Panoptes. That is deliberate: report_to exists precisely to abstract "the network only goes one way", and it covers all of them the same. There is no Tailscale integration in the code and there should not be — it would make one product the privileged path for a problem that is already solved neutrally.

A public reverse proxy, if you insist: terminate TLS, require your own authentication in front (the board's token is not enough on the open internet), and accept that you now need a public hostname per Argus for the links to work — which multiplies the exposure by the number of machines you own. Argus's own notes on this apply, more so.