Tailscale connection and device-name control.

Commands

connect/3, configure/3 and disconnect/1 return :ok when accepted, or {:error, reason}. Only one daemon operation runs at a time. Acceptance does not mean completion: read status/1 for :operation and :error. Editors pass expected:, the hostname their draft started from; a changed hostname is rejected as stale before any daemon write.

Queries and notifications

status/1 returns sanitized daemon observations. login_url/1 is a private query; its result never enters status or notifications. Subscribe with observe/1 before reading, then reread when properties change.

The optional server argument defaults to this module. The daemon retains identity and preferences across process restarts; user commands are not replayed. Once online with a DNS name, an owned worker configures HTTPS Serve on port 443 to the gateway UI on port 4000. It runs once per observed DNS name, including startup and rename. A failed setup is not automatically retried; connect or save the same device name to retry. The daemon persists the listener configuration.

:remote_unavailable reports daemon loss after a connect request or an active authentication/connection observation. An available daemon clears it, including while offline or awaiting approval. Stopped/unconfigured connections do not require a daemon for this alarm. Unknown startup observations preserve an old report; no connection intent is persisted here.