Networking — the Tailnet requirement
OpenWatari is multi-device. The secure way to connect your phone, laptop, and glasses to the same 24/7 brain on a VPS is a private mesh VPN — a Tailnet.
Why a Tailnet
The brain binds 0.0.0.0 so devices can reach it — but you must never expose that on the public internet. A Tailnet (Tailscale, WireGuard under the hood) gives every one of your devices a stable private 100.x.y.z address that is unroutable to anyone else. The brain is still additionally guarded by the JARVIS_API_AUTH_TOKEN bearer the wizard generates — defence in depth.
Install Tailscale on every device
Sign in to the same Tailscale account everywhere:
| Device | How |
|---|---|
| VPS / brain host (Linux) | curl -fsSL https://tailscale.com/install.sh | sh then sudo tailscale up |
| Laptop (Windows/Linux) | install the Tailscale app, sign in |
| Mac (macOS) | Tailscale from the Mac App Store (or brew install --cask tailscale), sign in |
| iPhone | Tailscale from the App Store, sign in (keep it connected) |
| Android | Tailscale from Google Play, sign in (keep it connected) |
| Mentra OS glasses | via their companion phone, which is on the tailnet |
| Home Assistant | the brain reaches HA over the tailnet (or your LAN) |
Find your brain host's tailnet IP with tailscale ip -4 on the VPS (e.g. 100.107.141.83).
How each connection uses it
| Path | Endpoint |
|---|---|
| Laptop / glasses edge → brain | ws://<brain-tailnet-ip>:8765/voice |
| iPhone Siri Shortcut → brain | http://<brain-tailnet-ip>:8766/talk?token=… |
| Remote PC-control executor → brain | ws://<brain-tailnet-ip>:8765/control |
| Recurring-reminder ticker | http://<brain-tailnet-ip>:8770 |
No port-forwarding, no public exposure, no dynamic-DNS. Set these in .env (the wizard's vps deployment shape fills JARVIS_BRAIN_HOST=0.0.0.0, generates the token, and builds the edge URL from the host you give it). See Configuration.
Firewall
On a multi-device LAN test (no tailnet) you'd open ports 8765/8766 in the OS firewall; over a tailnet you generally don't need to, since traffic arrives on the Tailscale interface. Keep the public internet closed to these ports regardless.