Tailscale Remote Access

Overview
Reach ChitUI (and the ChitUI Remote Android app) securely from anywhere — no port forwarding, no exposed ports, no cloud relay to babysit. This plugin installs and manages Tailscale straight from the ChitUI web UI, joining your Pi to your own private network (a “tailnet”) that only your logged-in devices can reach. All traffic is end-to-end encrypted with WireGuard.

What it does

• One-click Tailscale install, straight from the ChitUI web UI — no terminal needed on most setups.
• Guided login with a clickable auth link and a QR code, so you can approve the Pi from your phone or laptop.
• Status card showing the Pi's Tailscale IP, MagicDNS name, connected account, and how many other devices (peers) are online.
• Connect / Disconnect / Log out controls, all from the browser — no SSH needed for day-to-day use.
• A dedicated “Connect ChitUI Remote” card showing the exact server address to enter in the Android app, with a QR code to scan it in.
• Detects locked-down systems (passwordless sudo disabled) and shows a one-time command to run over SSH — after that, everything is one-click again.

In ChitUI

The plugin adds a Tailscale tab next to the other printer-info tabs. A status badge always shows where things stand — not installed, needs login, connected, or disconnected — and the tab updates itself automatically every few seconds, so you never need to refresh the page. Once connected, it shows the Pi's Tailscale IP, MagicDNS name, account, and peer count, with Disconnect / Log out buttons and the ChitUI Remote connection card underneath.

Before You Start (outside ChitUI)

Tailscale is a separate, free service — you'll need an account before the plugin can log the Pi in.

• Create a free account at tailscale.com (sign in with Google, Microsoft, GitHub, Apple, or email). The free Personal plan allows up to 6 users with unlimited devices — plenty for a household.
• To reach ChitUI from your phone, install the Tailscale app (tailscale.com/download — available on the Play Store and App Store) and log into the same account you used for the Pi.

How to Configure It

Important: Tailscale must be enabled during ChitUI's first install

This plugin can only install and manage Tailscale if support for it was included when ChitUI was first set up, via the install.sh script.

If you skipped it the first time around, SSH into the Pi and re-run the installer:

bash install.sh

You can answer through the earlier prompts as before — just say yes when it asks about Tailscale this time.

1. Open the Tailscale tab and click Install Tailscale. On most Raspberry Pi OS setups this just works and you'll see the install log stream by.

2. If you instead see a blue “One-time setup needed” banner, this system has passwordless sudo disabled — see the Note below.

3. Once installed, click Start Login. Click the Open auth link button (or scan the QR code with your phone) and sign in with your Tailscale account to approve the Pi — this opens a page on login.tailscale.com.

4. Once approved, the tab switches to Connected and shows the Pi's Tailscale IP, MagicDNS name, account, and peers.

5. (Optional) To connect the ChitUI Remote Android app: install the Tailscale app on your phone and log into the same account (see above), then in ChitUI Remote set the server address to exactly what's shown in the Connect ChitUI Remote card — or just scan its QR code.

Note:

• Some systems (particularly hardened or non-default setups) disable passwordless sudo, which the plugin needs to install and control Tailscale. If you see the setup banner, SSH into the Pi once and run the command shown, e.g.:

sudo bash /path/to/plugins/tailscale/setup_sudo.sh

• This installs Tailscale (if needed) and grants ChitUI a narrow, passwordless sudo rule for the tailscale binary only — nothing else. Come back to the web UI afterward; the page updates on its own and everything from then on is one-click.

Good to Know

• Only devices logged into your own tailnet can reach the Pi — nothing is exposed to the public internet, and no router configuration or port forwarding is needed.
• In the Tailscale admin console, it's worth disabling key expiry for the Pi (device row → ••• menu → Disable key expiry) so you're not prompted to re-authenticate every few months.
• Logging out from the Tailscale tab disconnects remote access immediately — only do this if you still have another way to reach the Pi (e.g. on the same local network).
• The plugin never touches your Tailscale connection on ChitUI shutdown/restart, so remote sessions already connected through it aren't interrupted.
• MagicDNS gives the Pi a friendly name (like chitui-pi.your-tailnet.ts.net) instead of a bare IP — enable it in the admin console if it isn't already on.