Remote access
Off unless you switch it on. When it is on, your phone reaches the app over your own Tailscale network, and only over it. The app is never on the public internet.
How it works
Tailscale is a private network between your own devices. WorkflowRemix publishes itself to that network with Tailscale Serve, at an address like https://your-computer.your-tailnet.ts.net. Only devices signed in to your tailnet can connect, the traffic is encrypted between them, and HTTPS runs on top.
It never uses Tailscale Funnel, the feature that publishes to the internet. If something else on the computer switches Funnel on for that address, the app answers nothing through it.
Switching it on
Settings → Remote access walks through it and shows the live state of every step.
- Tailscale installed on this computer.
- Signed in to it. If this computer's Tailscale key runs out within a month, the page says so here: when it does, the address stops answering as if the computer were asleep.
- MagicDNS and HTTPS certificates on for your tailnet. Note that an HTTPS certificate puts your computer's
.ts.netname in public certificate logs. The name, not what is behind it. - An app password of at least 12 characters. A shorter one set earlier has to be set again.
- Switch it on. A tailnet's first use of Serve asks for approval in the Tailscale admin console; the page shows the link.
- On your phone. The page lists the ways in, below.
Remote access works while the desktop app is open. Closing the app switches the address off, and opening it again switches it back on.
Who gets in
A request reaches the password screen only if all of this holds:
- it came through your tailnet, at the published name, and not through Funnel;
- Tailscale named an account for it. A tagged device carries none and is turned away, so never tag the phone;
- with Only my Tailscale account on, which it is unless you switch it off, that account is yours.
Then the password. Wrong guesses are limited per account. A phone stays signed in for 8 hours while in use and signs in again after a week however much it is used. Settings → Security → Sign out every device, pressed at the computer, ends every session at once.
On your phone
| Way in | Needs | Keeps on the phone |
|---|---|---|
| The phone app | Not released yet. It will pair from a code on the computer's screen and needs no Tailscale app: it joins your tailnet itself, as a device of its own. | Nothing in backups or the app switcher. |
| A home-screen web app | The Tailscale app on the phone, signed in with your account. | Its data goes into the phone's backups. |
| A private browser tab | The Tailscale app on the phone, signed in with your account. | Nothing, the job list included. |
For the last two, open the address shown on the Remote access page in the phone's browser and sign in with the app password.
What a phone may do
A phone uses the app. It does not change the computer.
| A phone can | Only the computer can |
|---|---|
| Browse, view, favourite, move and delete media | Change any setting: paths, the ComfyUI address, API keys, media caching, the safe-mode list |
| Run and cancel remixes | Set or change the password, or switch remote access on or off |
| Use the prompt library, the rules and the workflows | Start ComfyUI, restart the app's server, restore a backup |
| Read Settings | Sign out every device |
Settings on a phone are shown read-only, with a line saying where to change them. Of ComfyUI itself a phone reaches only the handful of calls the app makes: queue a run, read the queue, cancel, upload an input image. The rest of ComfyUI's own interface is not reachable through the app.
Safe mode is held on for every remote device: a file your filter list flags is not shown there at all, and neither is the list. Show flagged media on remote devices, ticked at the computer, lifts that.
Locking your tailnet down
Some protections only Tailscale can give. The Remote access page lists them under Lock it down:
- access rules that let only your own devices reach the port the address uses (443, or 8443 or 10000 if you chose one of those);
- device approval, so a new device cannot join unnoticed;
- removing a phone you no longer use from the Machines page of the admin console.
If the app did not close normally
Closing the app switches the address off. If the app was ended outright, by a power cut say, Tailscale goes on publishing an address that nothing answers until you open the app again. The page shows the one command that turns the address off by hand.