Remote access

Élise is never published on the Internet. There is no public mode. A caregiver’s phone or computer must be connected to Tailscale and invited by the family.

Enable private access

1. At home, open the initial assistant or Settings → Remote access, then choose Enable private access.
2. Open the Tailscale link shown and attach the machine to the family’s account. No key ships with Élise OS.
3. Élise detects the approval and enables its https://elise.<your-tailnet>.ts.net:8443 address. Port 443 and the machine’s other services are not changed.
4. Test the link from a phone connected to Tailscale.

Invite a caregiver

1. First create the caregiver in Élise and choose their role.
2. In the Tailscale admin console, share only the Élise machine with their email address.
3. Ask them to install Tailscale on their phone or computer.
4. Send them the private link, or have them scan the QR code shown in Settings. The mobile app then remembers both the local and remote addresses of the same installation.

For a permanently installed hub, the family can disable key expiry for the Élise machine only.

Revoke access

• Revoking the share in Tailscale cuts the network path immediately.
• Disabling the account in Élise also ends its session and permissions.

What is exposed

On the tailscale0 interface, a strict rule only accepts:

Port	Use
8443/TCP	Caregiver space over HTTPS
8555/TCP+UDP	Camera video and intercom, with short-lived tickets

PostgreSQL, MQTT, Home Assistant, the API documentation and initial setup are not reachable remotely. SSH administration happens from the local network or the server console.