Tailscale is the recommended private transport for a personal deployment, but it is optional. VocaGateway can also use a trusted LAN HTTP URL or an HTTPS VPS as described in deployment.
For private HTTPS, bind the gateway to 127.0.0.1:8765 and let Tailscale Serve
add tailnet-only ingress in front of it. This overrides the gateway's
all-interface default and avoids exposing port 8765 directly to the local
network. Never use Funnel for this project.
- Install and sign in to Tailscale on the gateway host and on the phone (iPhone or Android).
- Confirm both devices appear in the same tailnet.
- Start or publish the gateway on host loopback and verify liveness locally.
For a native macOS or Linux process:
VOCAGATEWAY_BIND_HOST=127.0.0.1 uv run vocagatewayFor Docker, keep the Compose default in .env:
VOCAGATEWAY_PUBLISH_HOST=127.0.0.1
VOCAGATEWAY_PUBLISH_PORT=8765Then verify the process before configuring Serve:
curl --fail http://127.0.0.1:8765/health/liveCreate or inspect the tailnet-only HTTPS proxy with:
tailscale serve --bg 8765
tailscale serve statusUse the private HTTPS URL shown by tailscale serve status in the iPhone or
Android app. Do not use the local HTTP address from the phone.
The HTTPS endpoint can be live while transcription readiness is still 503.
After downloading/selecting a model in the WebUI, verify both paths:
curl --fail http://127.0.0.1:8765/health/ready
curl --fail https://your-device.your-tailnet.ts.net/health/readyTo reverse the Serve configuration:
tailscale serve resetApply a restrictive tailnet policy so only the user's phone and administrative devices can reach the gateway host. Tailscale identity is an additional network layer; the VocaGateway bearer token is still required.
Command syntax was checked against the current Tailscale Serve CLI reference.