Tailscale — your machines, one private network
Tailscale puts every device you own — laptop, Mac Mini, phone, a server anywhere — on one private, encrypted network (WireGuard under the hood). No port forwarding, no router configuration, no exposing anything to the public internet. Your laptop can SSH into your Mini from a coffee shop as if they were on the same desk.
This is the connective tissue of a sovereign setup: once your always-on machine (see /ai-agents-setup) is on your tailnet, every dashboard, agent, and file on it is reachable from your phone — privately.
Free tier: up to 3 users and 100 devices — more than enough for a personal empire. No card needed.
Step 1 — Install on every device
macOS:
brew install --cask tailscale
(or the Mac App Store / tailscale.com/download)
iPhone / Android: install the Tailscale app from your app store.
Linux (a server, a Pi):
curl -fsSL https://tailscale.com/install.sh | sh
Windows: installer at tailscale.com/download.
Step 2 — Log in (same account everywhere)
Open the app (or run sudo tailscale up on Linux) and log in — Google, GitHub,
Microsoft, or passkey. Every device you log into with the same account joins the
same tailnet automatically. That's the whole setup.
Check it worked:
tailscale status
Success looks like: a list of your devices, each with a 100.x.y.z address and a
name. From any device, ping another:
tailscale ping your-other-machine
Step 3 — MagicDNS: names, not numbers
Tailscale gives every device a stable name (your-machine.tail-xxxx.ts.net, plus
the short name inside your tailnet). Use names everywhere; the 100.x addresses are
for scripts.
ssh you@your-mini # works from anywhere, no IP memorized
Step 4 — Tailscale SSH (skip key management entirely)
On the machine you want to reach:
sudo tailscale up --ssh
Now any device on your tailnet can SSH in, authenticated by Tailscale identity — no key files to copy around. (Your existing SSH keys keep working too.)
Step 5 — tailscale serve: your dashboards on your phone
The killer feature for a builder. A dev server running on your Mac becomes an HTTPS URL reachable from every device on your tailnet:
tailscale serve 8971
That takes whatever runs at localhost:8971 and serves it at
https://your-machine.tail-xxxx.ts.net — with a real certificate, visible ONLY
to your devices. Open it on your phone from anywhere. Check with:
tailscale serve status
This is how you check your dashboards from the couch: the server never touches the public internet.
Step 6 — tailscale funnel: public, when you mean it
Same syntax, opposite audience — tailscale funnel 8971 publishes to the whole
internet through Tailscale's relays. Useful for quick demos. Treat anything
funneled as production: it is public. For a permanent public site, a real deploy
(the way this hub runs) beats a funnel.
The pattern this unlocks
| You have | Add Tailscale and get |
|---|---|
| A Mac Mini running agents 24/7 | SSH + dashboards from your laptop and phone, anywhere |
| A local AI (Ollama) on one machine | Every device can hit its API privately — your own private AI endpoint |
| A dev server on your laptop | A phone-viewable HTTPS URL in one command |
| Family/team machines | A private network with access controls (ACLs) you write |
Rules
- Serve = private, funnel = public. Know which one you typed.
- The tailnet is an extension of your machines — a device on it can reach everything you share. Only enroll devices you control.
- Lock down as you grow: Tailscale ACLs let you say exactly which device may reach which port. Default-open is fine for one person; write ACLs before you invite anyone else.
Part of KeyzHub — take the code, build your own. Pairs with /ai-agents-setup and /local-ai-setup.