Skip to content

Domain (outside access)

Engineering → Starbase → Domain lets people (and the devices you let out) reach Starbase from outside your home, through your own address, like starbase.example.com.

It goes through a tunnel or a reverse proxy you already run, never Starbase's own port opened on your router. It's off until the Captain turns it on, at home, with the PIN, once the Captain has two-step sign-in.

Three ways to set it up

The Domain page shows these steps filled in with your own addresses.

Your own domain on Cloudflare; nothing opens on your router.

  1. In Cloudflare's dashboard: Networking → Tunnels → Create Tunnel. Run the install commands it shows on the Starbase computer.
  2. In the tunnel's Routes: Add route → Published application. Your hostname, and the service URL https://localhost:3010. Under Additional application settings → TLS, turn on the one that disables TLS verification (Starbase's certificate is its own).
  3. Put https://<your hostname> in Your address. The tunnel's address is 127.0.0.1.

No domain needed: the address ends in .ts.net.

  1. Install Tailscale on the Starbase computer and allow Funnel for it in Tailscale's admin console.
  2. Run tailscale funnel --bg https+insecure://localhost:3010 (once; it stays on).
  3. tailscale funnel status shows your address: put it in Your address. The tunnel's address is 127.0.0.1.

Caddy, nginx, Nginx Proxy Manager…

  1. Send your name to https://<Starbase's home address>:3010, without checking its certificate (it's Starbase's own), with WebSockets allowed.
  2. The proxy needs a real certificate for the name, must keep the name (the Host header) and say who it's forwarding for (X-Forwarded-For).
  3. Put the proxy's address in the trusted list. Only the proxy is open to the internet.

Check it opens your address the way a phone away from home would, and says what it finds.

What's different from outside

  • A password alone never signs anyone in: everyone needs two-step sign-in. "Keep me signed in" lasts a week, and a session started at home doesn't work from outside.
  • Outside is never home: no Guests, no pairing devices, no making the Captain, no recovery codes, no turning two-step off, no changing outside access, no restoring a backup.
  • The AI's hands never reach the Starbase PC or another computer from outside: see Outside the home.
  • While it's off, anything arriving from outside is turned away.

Visitors' real addresses come from the tunnel or proxy only when it's one you trust, so sign-in limits and the audit log see each visitor.