0.16.0 - Tailscale, right on the device
WireGuard works, but it wants somewhere to connect to: a peer with a fixed address, or a port opened on your router. Tailscale is the version of that problem that solves itself, and the device now speaks it natively.
Set a Tailscale auth key in Settings and the device joins your tailnet. It is then reachable at its 100.x address, or its MagicDNS name, from anywhere you are signed in - NAT traversal handled for it, nothing forwarded, no gateway machine in the middle. It is built on a native client ported to ESP-IDF 6, and it runs on its own task, so joining never holds up boot.
The certificate follows: it is re-issued to name the tailnet address and the MagicDNS name, so the console is trusted over Tailscale the same way it is on the local network.
The console is installable. It ships a manifest, a service worker and icons, so a phone can add it to the home screen and run it full screen. That also gets rid of the browser's own bars, which were eating the space you actually watch the machine in. Touch control became a proper trackpad with acceleration at the same time.
The device's own certificate authority is now named after the device, so it is recognisable in a phone's list of trusted credentials rather than being one of several identical entries.