tmux-next binds only to 127.0.0.1 and has no login of its own. The simplest
secure way to reach it from your phone is Tailscale: put
your machine and phone on the same private network, and only your own devices can connect.
No reverse proxy, no ports opened to the internet, no password to manage — and Tailscale
provisions HTTPS for you.
Nothing is exposed to the public internet. Where the Caddy guide puts the service behind a public domain and a login, this keeps it reachable only from devices on your tailnet. Being on the tailnet is the authentication — which is why it's both simpler and safer for a personal setup.
127.0.0.1:7682 (the default port).# listens on 127.0.0.1:7682 — localhost only, which is exactly what you want
bunx tmux-next
Keep it bound to localhost. Tailscale will be the only thing that can reach it, so there's no reason to expose the port any wider.
One command proxies HTTPS on your tailnet to the local port and prints the URL:
# --bg keeps it running in the background and across reboots
tailscale serve --bg 7682
It prints something like https://your-machine.your-tailnet.ts.net, proxying to
http://127.0.0.1:7682. Tailscale obtains and renews the certificate automatically.
Check what's being served any time:
tailscale serve status
With Tailscale connected on your phone, open that https://…ts.net URL in the
browser. That's the whole thing — no login prompt, because being on your
tailnet is the authentication. Add it to your home screen for a one-tap app.
The WebSocket just works. The terminal's live data is a WebSocket, and
tailscale serve proxies it (as wss) with no extra config — none of the
WebSocket-auth juggling the Caddy guide has to do, because there's no separate login layer to
reason about.
By default, only your own devices. To let someone else in, share the machine to their Tailscale account (node sharing), or use your tailnet's ACLs — the same as any service on a tailnet. Everyone who connects needs Tailscale; that requirement is the point.
Do not tailscale funnel this. Funnel exposes a service to the
public internet, and tmux-next has no login of its own — Funnel would put a shell on the
open net for anyone to reach. Use serve (tailnet-only). If you genuinely need public
access, use the Caddy guide instead, which adds a real login.