Likely causes
| What you see | Likely cause |
|---|---|
| Herald: “Check that Tailscale is connected on this phone and on the computer” | Tailscale is off, signed out or on another tailnet on one device |
| Tailscale says Serve isn’t enabled and shows a link | Serve hasn’t been approved for your tailnet or this machine |
| The ts.net address has no certificate | HTTPS certificates are turned off for your tailnet |
| Linux refuses to change the serve settings | Your user isn’t allowed to operate Tailscale |
| Hermes answers HTTP 400 “Invalid Host header” | Hermes isn’t set to accept the ts.net name |
| Hermes Desktop broke after you set public_url | An older Hermes that also gated the desktop’s own backend |
Check these in order
- Connect Tailscale on both devices
Open Tailscale on the phone and the computer and make sure both are signed in to the same tailnet.
- Let the helper redo the setup
Run
npx herald-setupagain. When Tailscale is running it picks your Tailscale name, writes the dashboard settings and runs Tailscale Serve, then prints a fresh QR code. - Find your machine’s name
Drop the trailing dot from the result.
tailscale status --json | jq -r .Self.DNSName - Publish the port with Serve
Approve Serve if Tailscale shows a link, turn on HTTPS certificates in the Tailscale admin console if asked, and on Linux let your user operate Tailscale with
sudo tailscale set --operator=$USER.tailscale serve --bg 9119 - Tell Hermes the name
In
~/.hermes/config.yaml, setdashboard.public_urlto your https ts.net address. A non-loopback name also needs a username and password provider; see dashboard sign-in errors. - Update Hermes if the desktop app broke
On older versions, setting
public_urlalso gated the loopback backends Hermes Desktop starts for itself. Runhermes update. - Check Hermes locally
On the computer, this should answer. Then connect Herald to the https name or scan the new QR code.
curl http://127.0.0.1:9119/api/health
How the pieces fit
Hermes stays bound to 127.0.0.1, so only the computer itself can reach it directly. Tailscale Serve adds HTTPS and keeps the port tailnet-only, and dashboard.public_url tells Hermes to accept requests that arrive under the ts.net name. Because that name isn’t loopback, Hermes asks for a sign-in, and Herald uses the dashboard username and password.
Use Serve, not Funnel. Funnel publishes the address on the public internet, and the Hermes docs reserve username and password sign-in for trusted networks.
Questions
Does my phone need Tailscale running all the time?
To reach Hermes at its Tailscale address, yes. Herald can’t switch Tailscale on for you.
Can I use plain http:// with Tailscale?
Herald allows http:// to Tailscale names and addresses, but Hermes still needs to accept the hostname and require a sign-in. The HTTPS setup above is the one npx herald-setup creates.
Should I turn on Tailscale Funnel?
No. Funnel exposes Hermes to the whole internet. Serve keeps it inside your tailnet.
