Same Wi-Fi at a glance
| Question | Same Wi-Fi | Tailscale |
|---|---|---|
| Security | Plain HTTP: password and chats cross your network unencrypted | Encrypted, and only your tailnet can reach it |
| Setup effort | Lowest: npx herald-setup | Low: an app on each device, then npx herald-setup |
| Works away from home | No | Yes |
| HTTPS | No | Yes, an automatic ts.net certificate |
| Cost | Free | Free Personal plan |
| herald-setup must keep running | Yes, it carries the connection | No, once Hermes runs on its own |
Pair over Wi-Fi
- Join the same network
Put the phone on the same Wi-Fi as the computer that runs Hermes.
- Run herald-setup
With Tailscale running, herald-setup prefers it. To pair over Wi-Fi anyway, give it the address yourself, for example
npx herald-setup --url http://192.168.1.20:9119.npx herald-setup - Scan the QR code in Herald
Tap Scan the QR code and point the camera at the terminal. herald-setup warns that plain HTTP is unencrypted before it draws the code.
- Leave the window open
herald-setup is what carries your phone’s connection to Hermes. Close it and the Wi-Fi address closes too; if the helper started Hermes, Hermes stops as well.
What herald-setup does on Wi-Fi
- Writes a username and a scrypt-hashed password, and sets
dashboard.public_urlto your Wi-Fi address so Hermes accepts it. - Keeps Hermes on 127.0.0.1, so health checks and local tools keep working.
- Opens only that one address, and never
0.0.0.0unless you pass--bind-all. - Opens it only once Hermes asks for a password, re-checks every few seconds, and closes it if Hermes stops asking.
- Forwards only requests for that exact address and port, and caps connections at 64 in total and 16 per device.
- Notices when the computer’s address changes, for example after a new DHCP lease, closes it and asks you to run it again.
Addresses Herald accepts over plain HTTP
| Address | Plain HTTP? |
|---|---|
| Private IPv4: 10.x, 172.16–31.x and 192.168.x | Yes |
Tailscale: 100.64.0.0/10 and *.ts.net names | Yes |
localhost, name.local and single-label names such as mac-mini | Yes |
| Self-assigned 169.254.x.x | Yes, but herald-setup warns that it changes and phones usually can’t reach it |
.lan, .home.arpa and .internal names | No, names are judged as written |
| Public IP addresses and domains | No, use https:// |
Herald and herald-setup share this rule, so the helper never pairs an address the phone would refuse.
Doing it by hand
hermes serve --host 192.168.1.20 --port 9119dashboard.basic_auth as in the Tailscale guide; public_url isn’t needed. Bind the LAN IP, not 0.0.0.0, so Hermes isn’t exposed on VPNs, guest networks or a public interface.Troubleshooting
- Couldn’t reach the address. Check that both devices are on the same network, that
hermes serveis running and that any firewall allows TCP port 9119. See Herald can’t connect. - It worked yesterday. The computer’s Wi-Fi address has probably changed. Run herald-setup again and rescan the QR code.
- Something else is using port 9119. Stop the other server, for example with
hermes serve --stop, and run herald-setup again. - A 169.254 address. The computer gave itself an address because no router answered. Join the phone’s Wi-Fi so it gets a normal one.
Questions
Does this work on mobile data?
No. A Wi-Fi address only works inside your own network. To reach Hermes from anywhere, use Tailscale.
Can I use my computer’s .local name?
Yes. Run npx herald-setup --url http://<name>.local:9119. It works when the name also resolves to an IPv4 address on your network.
Why must the herald-setup window stay open?
Hermes stays on 127.0.0.1, and herald-setup forwards your Wi-Fi address to it. That keeps Hermes off every other interface, but the forwarding only lasts while the helper runs.
Is plain HTTP on my home Wi-Fi safe?
It is unencrypted, so anyone who can watch traffic on the network could read your password and chats. herald-setup says so before pairing. It is a reasonable choice only on a network you trust.
