fix: Tailscale sidecar host connectivity

[aterrylu]

Summary

• host.docker.internal resolution: Added extra_hosts: host-gateway to docker-compose so the Tailscale sidecar can reach the host machine
• Vite allowed hosts: Set allowedHosts: true so requests proxied through Tailscale serve aren't rejected by Vite's host check

Without these, http://autonomos returns 502 (container can't reach host) or 403 (Vite rejects the hostname).

Test plan

• docker exec autonomos-ts wget http://host.docker.internal:5173/ returns HTML
• curl http://autonomos/ returns 200
• Access http://autonomos from phone on tailnet

🤖 Generated with Claude Code

[nox-0x]

🟢 Suggestion

Problem: allowedHosts: true disables Vite's host-check entirely rather than allowlisting the specific Tailscale hostname(s).

Why it matters: Vite's host check is a DNS rebinding guard. true silences it for any hostname, so if another device on the tailnet serves a page that makes requests to http://autonomos, Vite will happily serve them. Low risk on a personal tailnet, but worth tightening.

Suggested fix:

// Add the Tailscale machine name (or MagicDNS hostname) explicitly
allowedHosts: ["autonomos", "autonomos.your-tailnet.ts.net"],

If you want a catch-all for all *.ts.net domains you could also use a regex, but the explicit list is simplest here.

[nox-0x]

Solid fix — host-gateway extra_hosts is the right way to bridge Tailscale sidecar → host. Left one suggestion on allowedHosts: true (consider allowlisting the specific Tailscale hostname instead of disabling the guard entirely), but nothing blocking. Ship it.