From c45ee592f2e93ea1b3e586053475a1becd5ed540 Mon Sep 17 00:00:00 2001 From: taljeon Date: Fri, 4 Sep 2026 13:42:54 +0900 Subject: [PATCH] docs: make Serve the canonical remote entry point --- README.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 7e73b9f1..9c074e95 100644 --- a/README.md +++ b/README.md @@ -444,7 +444,13 @@ Set `environmentFiles` for secrets like API keys. Protected WebUI runtime keys f ### Remote access (SSH tunnel, Tailscale, phone) -The server binds to `127.0.0.1` by default. To reach it from another machine use an SSH tunnel (`ssh -N -L 8787:127.0.0.1:8787 user@host`, which `start.sh` prints for you over SSH), or join your server and phone to a [Tailscale](https://tailscale.com) network and browse to `http://:8787` with `HERMES_WEBUI_HOST=0.0.0.0` + `HERMES_WEBUI_PASSWORD` set. Full walkthrough (incl. a community ARM64-Android field report): [`docs/remote-access.md`](docs/remote-access.md). +The server binds to `127.0.0.1` by default. To reach it from another machine, +use an SSH tunnel (`ssh -N -L 8787:127.0.0.1:8787 user@host`, which `start.sh` +prints for you over SSH) or use the preferred [Tailscale Serve](https://tailscale.com/docs/features/tailscale-serve) +flow, which keeps WebUI on loopback behind tailnet-only HTTPS. Direct access to +`http://:8787` with `HERMES_WEBUI_HOST=0.0.0.0` and +`HERMES_WEBUI_PASSWORD` is a fallback when Serve is unavailable. Full setup and +the community ARM64-Android field report: [`docs/remote-access.md`](docs/remote-access.md). ### Manual launch (without start.sh)