You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/guides/web-app.md
+12Lines changed: 12 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,6 +14,18 @@ The hosted Admincraft page uses HTTPS. Browsers block an HTTPS page from connect
14
14
15
15
For the hosted web app, **Public certificate** (`wss://`) is the most reliable choice. A private-network connection can work from an Admincraft build served over HTTP, but should never be exposed to the public internet.
16
16
17
+
### Tailscale in the web app
18
+
19
+
A Tailscale address such as `100.x.y.z` cannot be used from the hosted page. **Private network** connects over `ws://`, which the browser blocks, and `wss://` is impossible for a tailnet address because no certificate authority will issue a certificate for it.
20
+
21
+
Use **[Tailscale Funnel](../server/SERVER_SETUP.md#alternative-tailscale-funnel-no-app-on-the-client)** instead. Funnel publishes the WebSocket on a `ts.net` hostname with a certificate that renews itself, which is exactly what the browser requires:
22
+
23
+
-**IP / Hostname:** the `ts.net` hostname from `tailscale funnel status`
24
+
-**Port:**`443`
25
+
-**Connection security:**`Public certificate`
26
+
27
+
The private tailnet address still works in the Windows and Android builds, which are not subject to mixed-content rules. So the rule of thumb is Funnel for the browser, tailnet address for the installed app.
28
+
17
29
## Self-signed certificates
18
30
19
31
Web pages cannot install or pin a certificate for a WebSocket connection. The **Self-signed certificate** option is therefore hidden in the web app.
0 commit comments