# Tailscale Deployment

The dashboard is intended for daily private access through Tailscale.

## Local Docker deployment

```bash
cp .env.example .env
docker compose up -d --build
```

Frontend is exposed on local port `3000`, backend on `8000`.

## Tailnet-only access

```bash
tailscale serve 3000
```

Tailscale Serve exposes the frontend to your Tailnet. ACLs still apply. Use Funnel only if you intentionally want public internet exposure.

## Reverse proxy shape

```text
Tailscale Serve HTTPS
  ↓
Frontend / Nginx
  ↓
FastAPI backend
  ↓
Postgres / Redis / storage
```

## Identity headers

If Tailscale identity headers are used later, the backend must only trust them when it is reachable exclusively from localhost/Tailscale or a trusted reverse proxy.

## TikTok review caveat

Tailscale is ideal for private operations. TikTok App Review may require the demo domain to match the configured website URL. Prepare:

- `AUTOSHORTS_APP_BASE_URL`
- `AUTOSHORTS_PUBLIC_APP_URL`
- `PUBLIC_APP_URL`
- staging mode
- reviewer/demo account
- server-side secrets only