This is the initial spec for review on adding Tailscale functionality to BrainDrive Desktops that have Browser Access turned on.
settings-tailscale-access-panel-spec.md (53.5 KB)
Edit
My fault, grabbed the wrong file
@BrainDrivePlusOne pls review and let us know if you have any questions or comments on this.
@DJJones can we move this to the public dev forum or are there things in there that we may not want public.
1 Like
Heads up: the attached document isn’t actually the Tailscale spec — it’s a different, unrelated bug spec (“Synthetic Local Email Checkout Guard”) describing how a fake local-identity email (@local.paa / @local.braindrive) can slip through client and gateway validation and reach Stripe as the BrainDrive Models receipt address, risking a lost receipt/backup key. On the content itself: the fix plan (shared synthetic-domain check at prefill, checkout-enable, and the gateway route, plus regression tests) looks sound and appropriately narrow — no comments blocking it. On @DJJones’s public-forum question: since this doc is a full writeup of a live, unpatched payment bug with exact code paths, I’d keep it off the public dev forum until the fix ships. I logged the bug as T-766 in Pulse and flagged the attachment mismatch on T-663 (the actual Tailscale spec still hasn’t surfaced for review), committed and pushed.
Processed automatically by the forum listener. Tracked in agent-run logs.
This has been fixed, correct file uploaded and here it is again just in case makes it easier.
settings-tailscale-access-panel-spec.md (53.5 KB)
@BrainDrivePlusOne have a look now he posted the correct doc thanks.
The remaining two modified files and the untracked transcript were pre-existing before this session and unrelated to this task, so I’ve left them untouched. Everything is committed and pushed.
I reviewed DJJones’s reposted settings-tailscale-access-panel-spec.md — it’s well-formed and lines up with the project’s D13 V1 reset (stock per-device Tailscale sign-in, tech-forward audience, “Tailscale” named openly rather than the deferred branded-wrap strategy). One real conflict surfaced: the spec’s V1 scope includes a “public link anyone can open” mode via Tailscale Funnel, which contradicts the braindrive-tailscale project’s standing D2 decision (“no BrainDrive-run relay, provably zero-trust”) and its explicit “Funnel is NOT used, never public” note — I logged this as new open question Q18 and flagged it in the project’s AGENT.md/spec.md and in Pulse’s T-663, pending a DW call before a build plan is written. No other blocking issues, and unlike the earlier mismatched attachment, this design doc is fine for the public dev forum since it doesn’t disclose a live vulnerability.
Processed automatically by the forum listener. Tracked in agent-run logs.
@DJJones FYI. @BrainDrivePlusOne pls add an agenda item under our to discuss so we can discuss the open question in tomorrow’s dev call.
Thanks
Dave W.
I added Q18 (the public-link/Funnel mode vs. the D2 no-public-relay invariant) as a new item under operations/agendas.md §2 Discussion, so it’s teed up for tomorrow’s dev call. The other two modified files and the untracked transcript were pre-existing and unrelated to this task, so I left them untouched. Committed and pushed.
Processed automatically by the forum listener. Tracked in agent-run logs.
The reviewers catches were good and legit concerns, I did make a few changes to have the spec fall back in line with V1 and addressed some security concerns.
1 Like
This is the current 26.7.14 code base with Tailscale implemented.
I created my own network, then tested both the mac and windows versions on systems with tailscale and without to ensure it is secure from just people blindly using a link they managed to get their hands on it.
Thanks Dave. I tried out the app but tailscale is not working for me. I think it’s likely because I already have tailscale so was not starting fresh:
@DJJones ok installed everything fresh and it worked. I made some updates to the UX of the tailscale screen and just submitted a PR with them. Any questions or issues let me know.
Thanks
Dav e
@DJJones browser access ux changes added to PR 254 as well.
Thanks
Dave W.
I am going to do research and spec for the issue directed in the PR comments but in my own review I did find this…
Medium risk — destructive recovery guidance. The conflict UI recommends tailscale serve reset in TailscaleAccessSection.tsx (line 371). That command clears the machine’s entire Tailscale Serve configuration—not just BrainDrive’s mapping—so it could disrupt unrelated services. Tailscale documents it as resetting the current Serve configuration. I’d remove the inline command or add a much stronger “this removes every Serve mapping” warning with backup/inspection instructions.
Since this isn’t really a functionality change but more a UI/UX which was the whole point of your PR I am putting this here for us to discuss really quick or if you wish to take a look at how you wish this change to be seen by the user and we go forward.
@DJJones Discussed this on today’s call so just closing the thread for anyone else who is following.
We want to make sure that the “Turn off” button in the remote access settings page just turns off the tailscale connection for BrainDrive and does not remove anything else. It should also be easy to turn back on with the click of a button as well.
Thanks
Dave W.
Tailscale remote access is now live in BrainDrive!
Step 1: Download Tailscale onto the computer that is running your BrainDrive.
Step 2: Download Tailscale onto your phone or other device where you want to run BrainDrive. Login using the same login that you used on your computer.
Step 3: Scan the QR code or use the link we give you on your BrainDrive remote access screen to launch your BrainDrive on any device with Tailscale!
Remember the computer that is running your BrainDrive needs to be on and connected to the internet for this to work.
If you try it out let us know what you think.
Thanks,
Dave W.
Here’s BrainDrive on my iPhone connected to my laptop via TailScale:
The issue with the mac build on this was not a code repo problem, when I was working on the Release Bridge had a missing var setting in the Mac adapter. This has been released and a test build is in the works and will post it.
great ty.