run-tailscale-funnel

Get a local HTTP server reachable at a stable https://<node>.<tailnet>.ts.net URL, with a real Let's Encrypt cert, no port number in the URL, no ngrok account, no separate paid plan. The end state is a single public URL that any client on the public internet can hit — including sandboxed browser-automation agents that cannot reach the host's loopback.

This skill is the canonical operator for tailscale funnel. It owns the preflight, the port-slot decision, the bind-interface decision, the verification chain, and the teardown. It assumes Tailscale is already installed and the node is logged in to a tailnet.

Use this skill when

• the user wants an https://...ts.net URL for a local dev server, a static dist/ folder, an MCP server, a webhook receiver, or a tracing dashboard
• a browser-automation tool (agent-browser, Playwright in a microVM, Vercel Sandbox, AgentCore cloud browsers) fails to reach 127.0.0.1, 192.168.x.x, or 100.x.x.x and you need a public URL with a real cert
• the user asks to "make this reachable from my phone," "share this with a friend," "expose to the public internet," or "give me a tunnel"
• the user pastes a tailscale serve/tailscale funnel error or asks why tailscale funnel up shows "Funnel on" but the public URL is NXDOMAIN
• the user is wiring make local (or make tunnel, make share, make demo) into a project's Makefile

Do NOT use this skill when