The Phone Is on the Network, So the Service Is Not
Written later and filed to this date, as part of filling in every day of the year.
The heads-up display on my glasses shows the state of the loop: which automations are green, what broke, how much time has been handed back. The glasses do not talk to the box themselves. They talk to the phone, which runs the vendor’s app, which runs mine inside it, and mine polls a status service on the box. So the question on the loop’s first day was how a phone, on whatever network it happens to be on, reaches a service on a machine at home.
The first plan had the ordinary answer in it: the always-on node would carry a reverse proxy, and the proxy would give the service a public name. It is the answer every tutorial gives, and it works. It also means the service answers the internet, and everything after that is about keeping the internet from noticing: certificates, auth on every route, rate limits, logs to read, a name that resolves for anyone.
The fourth decision dropped the public path on the day it was proposed. The phone runs the mesh VPN client. The box is on the same mesh. The service listens on nothing the internet can route to, and the phone, wherever it is, reaches it over an encrypted link that nobody outside the mesh can see, let alone connect to. The reason in the decision is five words: most secure, no public exposure.
What this bought is visible in the app that resulted. It ships with a default address that is the box’s mesh address, which is safe to bake into a build because the address means nothing to a device that is not on the mesh. If that default never answers, the display does not say unreachable; it shows a setup screen that points at the phone-side step, because a fresh install on a phone that has not joined the mesh is the expected first state, not an error. And because the backend is private, the app carries a demo mode that renders twelve fixture states through the real pipeline with zero network, so that a reviewer who will never join my mesh can still see every face the display has.
The rule is the shape of every service on the box since: nothing binds an address the internet can route to, and the ones a browser opens sit behind a TLS front on the mesh’s own name. None of that is in the decision. The decision is one line, and the line is about a pair of glasses.
As recorded: “G2 transport = Tailscale on the phone.”