# Tailscale serve for local web UIs

Use this when a GUI or web app already works on `127.0.0.1:<port>` but needs to be reachable from another device on the tailnet.

## Checklist

1. Confirm local reachability.
   - `curl -I http://127.0.0.1:<port>` or `curl http://127.0.0.1:<port>/`
   - If this fails, fix the app first.

2. Expose it through Tailscale Serve.
   - `sudo tailscale serve --bg --yes <port>`
   - This usually creates an HTTPS endpoint under the node's `ts.net` name.

3. Verify the serve config.
   - `tailscale serve status`
   - The status should show the port proxy.

4. Verify the final external URL.
   - `python3 - <<'PY' ... urllib.request.urlopen('https://<node>.<tailnet>.ts.net/') ... PY`
   - Do not stop at a configured proxy; make sure the UI actually loads remotely.

## Common pitfall

If the app binds only to `127.0.0.1`, a raw `http://<tailscale-ip>:<port>` connection may refuse. Tailscale Serve avoids changing the app binding and is the quickest fix for remote access.