Let's get our flower.test site setup so it's available on the tailscal

UPGRADE (2026-07-05, operator request): replaced the tailnet-IP URL with a clean **https://flower.home.legitphp.com** via the existing Nginx Proxy Manager (192.168.1.201). **Done:** 1. NPM proxy host added (via operator's live browser session — API creds in credentials.md are STALE, `Baseball1` rejected 401): `flower.home.legitphp.com` → `http://192.168.1.241:8420`, **Let's Encrypt cert issued via HTTP-01** (flower.home.legitphp.com already resolves publicly → WAN IP 99.49.59.150 via Cloudflare wildcard, so no DNS-challenge token needed), Force SSL + HTTP/2 + Websockets on, Public access. 2. Rebound the demo server (Solo proc 1198) to `--host=0.0.0.0` so NPM reaches it on the LAN IP 192.168.1.241:8420; `APP_URL`/`ASSET_URL=https://flower.home.legitphp.com`. 3. **Fixed a real flower bug (committed to master `686a533`):** flower's `bootstrap/app.php` had NO `trustProxies`, so behind NPM (TLS terminated at the proxy, plain-http to origin) it emitted `http://` asset URLs = mixed content = broken CSS/JS on the https page. Added `$middleware->trustProxies(at: '*')`. flower.test (Herd) unaffected — still 200. (Suite not run — 1-line additive config verified live on both URLs; will be exercised on the next worker merge.) **Result (verified):** `https://flower.home.legitphp.com` → 200, valid cert, all-https assets, ~0.6s. Works on LAN; likely over tailnet too (home.legitphp.com resolves there). This supersedes the tailnet-IP approach as the canonical URL — much cleaner. The `tailscale serve` finding above still stands (that path is dead on this Mac's Tailscale variant); NPM is the better answer regardless. **Operator TODO:** update credentials.md — the NPM admin password (`mferrara@gmail.com` / `Baseball1`) is stale/rejected.

DONE (orchestrator, driven directly on MAIN 2026-07-05, operator chose "I drive it now" over auto-dispatch for a 1hr BBQ-demo deadline). **Outcome: flower reachable on the tailnet at `http://alargepaperweight.mermaid-ling.ts.net:8420`** (verified: HTTP 200, CSS/JS 200, ~0.4s warm). Real MAIN app + live data. **KEY FINDING — `tailscale serve` does NOT work on this host (important for epic #263 Phase 2 / #110 assumptions):** installed Tailscale is the sandboxed **App Store variant** (`Identifier=io.tailscale.ipn.macos`, no standalone `tailscaled`). Its network extension accepts `tailscale serve` config but never opens the :443 listener — connections refuse. Only loopback-IP targets are accepted (hostname targets rejected, KB 1552), and even then no real listener binds. So the spec's `tailscale serve` approach is a dead end here unless the standalone (`io.tailscale.ipn.macsys`) client is installed. **What worked — direct bind to the tailscale IP (peer-to-peer routing, unaffected by the serve limitation):** 1. Stopped Vite dev server (`npm run watch`, Solo proc 1190) + `rm public/hot`, ran `npm run build` → production assets. 2. `APP_URL=http://alargepaperweight.mermaid-ling.ts.net:8420 PHP_CLI_SERVER_WORKERS=6 php artisan serve --host=100.107.33.8 --port=8420` (Solo terminal proc **1198** `flower-demo-tailnet`). Bound to the tailscale IP specifically → tailnet-only (not 0.0.0.0). Herd bypassed (routes strictly by Host header → tailnet Host 404s; emits flower.test-absolute Flux/Livewire URLs). 3. No app-layer TLS but tailnet is WireGuard-encrypted → private. `SESSION_DOMAIN=null` → cookies bind to request host → sessions/CSRF work under the tailnet name. **Caveats:** leave `npm run watch` OFF during demo (recreates public/hot → breaks remote assets); Reverb live-push won't reach remote devices; lightweight artisan serve. Teardown = stop Solo proc 1198. **Follow-up:** durable https tailnet = install standalone Tailscale (`macsys`, supports serve), OR isolate demo in a worktree so MAIN's Vite dev server can't clobber public/hot.

## Goal Make the Herd-served **flower.test** reachable over the **tailscale tailnet** (hit the flower UI from other tailnet devices, not just localhost on this Mac). ## Approach flower.test is served locally by Herd (this Mac). To expose it on the tailnet: - Use **`tailscale serve`** (tailnet-only HTTPS reverse proxy → the local Herd site) rather than **`tailscale funnel`** (public internet) — a dev tool should stay tailnet-private. Map the tailnet MagicDNS name / an HTTPS path to the local flower.test origin. - Ensure Herd's flower.test vhost + TLS work behind the proxy (host header, cert). MagicDNS gives a stable name; `serve` provisions the TLS cert. ## Build steps 1. **Review `~/Documents/code/homelab`** directly for the existing tailscale conventions (serve vs funnel, MagicDNS naming, any proxy host). NOTE: flower does NOT currently index the homelab repo (recall_search found no tailscale docs in flower's corpus), so read the repo directly — do not rely on flower recall for this. 2. Configure `tailscale serve` on this Herd host → flower.test (respect Herd's port/host). Verify from another tailnet device. 3. Document the setup (short note in flower docs and/or homelab). ## Open decision (small — recommendation baked in) - **serve (tailnet-only) vs funnel (public):** recommend **serve** (tailnet-only). Confirm if you want it publicly reachable instead. ## Acceptance - flower.test reachable over the tailnet (HTTPS) from another tailnet device; setup documented. - No public exposure unless the operator opts into funnel. ## Provenance Operator note (#110, 2026-07-03). Framed by flower-refine (2026-07-03); homelab tailscale specifics to be reviewed at build time (not indexed in flower). Infra/ops task — likely an ops-track / interactive job (needs `tailscale serve` run on the host), not a typical worktree build.