DSH BYOK

An Android app that carries its own Tailscale node: bring your own auth key, reach one service on your tailnet, no VPN permission, no server of ours.

What it does Configuration — Tailscale auth key, target host (MagicDNS name or 100.x address), port, scheme, path, node hostname, and an optional self-hosted control server for headscale. Secure storage — the auth key is encrypted with an AES-256-GCM key that lives in the Android Keystore. On devices with a TEE or StrongBox, that key never exists in the app's address space at all. Connection test — a six-step check that names the step that failed, with timings, instead of returning one unhelpful boolean. Direct connection — traffic reaches the target over the tailnet, from inside the app. The target's own UI — Open the DSH UI renders the target's web interface in a WebView. It goes through a 127.0.0.1 reverse proxy inside the app, because the socket into your tailnet is created in Go and Android's HTTP stack has no route to it. The listener is loopback-only, requires a random per-session token, and its session cookie is cleared when you leave the screen. Updates, verified or refused — Check for updates reads dsh.apk.version from the update source (by default the target's origin, and configurable), downloads dsh.apk when that is newer, and installs it only when the bytes match dsh.apk.sha256 and the archive declares this app's package name. There is no timer and no background check; the result of the last attempt stays on the screen, including after the installer restarts the app. Provisioning by link or QR code — a deployment can hand the app its address as dshbyok://setup?target=…&mode=…. The app shows what the link would change and waits for a tap; a link that carries a credential-shaped field is refused outright, and one pointing at a host the address policy rejects cannot be applied. There is a generator that renders the QR code in your browser: site/provisioning.html. A QR code in the app, both directions — the settings screen draws this device's own configuration as a code another phone can scan, and scans a code with the camera (or reads one from a picture, with no camera permission at all). A scanned code is parsed and shown like any other link: it can never apply itself, and it can never carry a credential.