Daemion docs

How do I access Daemion remotely?

~5 minutes
Prerequisites: Running gateway, Tailscale installed

Daemion’s gateway listens on localhost:3001. To reach it from your phone, a tablet, or a remote computer, run it behind Tailscale — a zero-config private network that gives every device a stable hostname and end-to-end encryption.

Install Tailscale

Install Tailscale on both your gateway machine and the device you want to connect from:

Sign in with the same account on both devices. Tailscale puts them on the same private network automatically.

Find your machine’s Tailscale hostname

On the gateway machine:

bash

tailscale status

Look for the MagicDNS name — it looks like your-machine-name.tail1234ab.ts.net. That is your stable remote address. The gateway will be reachable at:

text

http://your-machine-name.tail1234ab.ts.net:3001

Verify the connection

From the remote device, ping the gateway health endpoint:

bash

curl http://your-machine-name.tail1234ab.ts.net:3001/health

{“status”: “ok”}

If that responds, you are connected. All API endpoints work the same over Tailscale as they do on localhost — same bearer token, same paths.

Open the app

If you have already paired the remote device (see pair a device), open the Daemion web app by navigating to:

text

http://your-machine-name.tail1234ab.ts.net:3001

The app loads from the gateway. Your bearer token is already stored in localStorage from when you paired — no re-pairing needed on the same device.

Pair a new remote device

To pair a phone or browser you have not connected before, open the pairing URL on that device:

text

http://your-machine-name.tail1234ab.ts.net:3001/pair

Enter the 6-digit code shown in your gateway terminal, or point the phone camera at the QR code. The device receives its own bearer token and is ready to use. See pair a device for full details.

Common questions

Q Do I need to open any firewall ports?
No. Tailscale uses NAT traversal — it punches through firewalls automatically. Port 3001 never needs to be exposed to the public internet.
Q Is the connection encrypted?
Yes. Tailscale uses WireGuard end-to-end encryption on top of the bearer token. Traffic between your devices is private even on untrusted networks.
Q Can I share access with someone else?
Tailscale supports sharing individual devices with other Tailscale accounts via the admin console. Any device you share will still need a valid bearer token from device pairing — the Tailscale layer and the Daemion bearer token are independent.
Q Does the gateway hostname change?
MagicDNS hostnames are stable as long as the machine stays in your Tailscale network. The address does not change if your IP changes.

What can go wrong

Remote access issues

Connection refused on port 3001 — The gateway may not be running, or it may only be listening on 127.0.0.1 instead of 0.0.0.0. Start the gateway with daemion start and confirm it binds to all interfaces.

tailscale status shows device as offline — The device may be asleep or Tailscale may have lost connectivity. Wake the machine and run tailscale up to reconnect.

401 on all requests — The bearer token stored in your browser was issued for a different gateway instance. Re-pair the device to get a fresh token for the current gateway.

What’s next?

  • Pair a device — full pairing walkthrough for phones and browsers