What Tailscale does
Tailscale joins your devices into a private network called a tailnet, with connections encrypted end to end. Tailscale Serve shares a service on one machine with the rest of your tailnet over HTTPS, using a certificate for the machine’s ts.net name. Nothing is opened to the internet and your router stays untouched.
For Herald, Serve sits in front of a Hermes that only listens on 127.0.0.1. Hermes treats the ts.net name as a non-loopback address, so it still asks for the dashboard password. Hermes’ docs say a password-protected dashboard belongs behind a VPN, and call Tailscale the clean option.
How the options compare
| Method | Security | Setup effort | Away from home | HTTPS | Cost |
|---|---|---|---|---|---|
| Tailscale | Only your tailnet can reach it, and the dashboard password still applies | Low: an app on each device and npx herald-setup | Yes | Yes, an automatic ts.net certificate | Free Personal plan |
| Same Wi-Fi | Password and chats cross your network unencrypted | Lowest: npx herald-setup | No | No, plain HTTP | Free |
| Cloudflare Tunnel | The sign-in page is on the public internet | Medium: an account, a domain and cloudflared | Yes | Yes, Cloudflare’s certificate | Free plan, plus a domain |
| Reverse proxy | Depends on who can reach the proxy | High: a domain, a certificate and proxy config | Only if the proxy is public or on your VPN | Yes, your own certificate | Free software, plus a domain |
Tailscale’s Personal plan is free for non-commercial use, for up to six users. Cloudflare Tunnel is available on every Cloudflare plan, including Free.
Set up Tailscale for Herald
- Install Tailscale on the computer
On a Mac, install Tailscale’s Standalone app. On Linux, run
curl -fsSL https://tailscale.com/install.sh | sh, thensudo tailscale up. Sign in to your tailnet. - Install Tailscale on your phone
Sign in with the same account, on every iPhone, iPad or Android device that runs Herald. Your Apple Watch and CarPlay don’t need it, because they relay through your iPhone.
- Turn on HTTPS certificates
In the Tailscale admin console, open the DNS page, check that MagicDNS is on, and select Enable HTTPS under HTTPS Certificates. If you skip this,
tailscale serveasks you to approve it. - Run herald-setup on the computer
It reads
tailscale status, pickshttps://<machine>.<tailnet>.ts.net, writes the dashboard password anddashboard.public_url, runstailscale serve --bg 9119and checks that the mapping took.npx herald-setup - Scan the QR code in Herald
Tap Scan the QR code in Herald. Keep Tailscale connected on the phone whenever you use Herald.
What herald-setup checks before changing Serve
- It keeps a Serve mapping that already points at Hermes.
- If another site is on
/, it shows what is there and asks before replacing it. With--yesit never replaces it. - It lists every other path or port served on the same name, since those stay published next to Hermes.
- It refuses to publish where Tailscale Funnel is on, unless you answer yes in a terminal.
--yesnever does. - If a first HTTPS certificate takes longer than 30 seconds, it reports that Serve is still finishing instead of failing.
--no-tailscale-serveleaves your Serve settings alone if you manage them yourself.
Doing it by hand
dashboard:
public_url: https://<machine>.<tailnet>.ts.net
basic_auth:
username: you
password_hash: 'scrypt$…'~/.hermes/config.yaml. Make the hash from your hermes-agent folder with its virtualenv active: python -c "from plugins.dashboard_auth.basic import hash_password; print(hash_password('your-password'))". Find your machine’s name with tailscale status --json | jq -r .Self.DNSName and drop the trailing dot.hermes serve --port 9119 # Still listens on loopback only.
tailscale serve --bg 9119 # Forwards the ts.net name to 127.0.0.1:9119.hermes update first: on older Hermes versions, public_url also locked the Hermes desktop app out of its own backends.Security notes
- Serve is tailnet-only. Funnel publishes to the public internet, and Herald doesn’t need it; turn it off with
tailscale funnel --https=443 off. - Tailscale’s access rules apply to Serve like any other service, so you can limit which people and devices reach the computer.
- Hermes still asks for the dashboard password: a non-loopback
public_urlalways turns its sign-in gate on. - Turning on HTTPS publishes your machine names in the public Certificate Transparency log. Rename a machine first if its name gives away something private.
- You don’t open any ports on your router.
Troubleshooting
- Serve is not enabled on your tailnet yet. Open the approval link herald-setup prints, then run it again.
- HTTPS certificates are not enabled. Turn them on in the admin console’s DNS page. See Tailscale HTTPS certificates.
- Tailscale refused the change for this user. On Linux, run
sudo tailscale set --operator=$USER, then run herald-setup again. - Tailscale is installed but not signed in. Run
tailscale up. Until then, herald-setup falls back to your Wi-Fi address. - The phone can’t connect. Check that Tailscale is on in the phone and that
tailscale serve statusshows the mapping. See Herald can’t connect.
Questions
Is Tailscale free?
For personal use, yes. Tailscale’s Personal plan is free for non-commercial use, with up to six users and unlimited user devices.
Do I need Tailscale Funnel?
No. Funnel puts a service on the public internet. Herald only needs Serve, which keeps Hermes inside your tailnet, and herald-setup won’t publish through Funnel without an explicit yes.
Can I use the Tailscale IP instead of the ts.net name?
Yes. Run npx herald-setup --url http://<tailscale-ip>:9119. Herald allows plain HTTP to Tailscale addresses because the traffic travels inside Tailscale’s encrypted connection, but the helper then has to stay open to carry it, as it does on Wi-Fi.
Do my Apple Watch and car need Tailscale?
No. Herald on Apple Watch and CarPlay relays through your iPhone, so only the phone needs Tailscale. See Herald on Apple Watch.
What happens if Tailscale is off on my phone?
Herald can’t reach the computer. For a ts.net or Tailscale address, its error message tells you to check Tailscale on both devices.
