How-To: See What Your Machine Already Exposes on Your Tailnet Before Omarchy 4.6 Sharing

Omarchy 4.6 will share local models with tailscale serve. Before I turn that on, I want to know what each machine already exposes. Here’s the five-minute check I run on my Omarchy boxes.

1. What is Tailscale serving?

tailscale serve status
tailscale funnel status

Serve is tailnet-only. Funnel puts it on the public internet. On a home inference box, Funnel should say nothing is configured.

2. What’s listening, and on what address?

sudo ss -tlnp

127.0.0.1 or [::1] means only this machine can reach it. 0.0.0.0 or * means every interface, including your LAN. Model servers like Ollama should stay on loopback and go through Serve.

3. Who can reach this box?

tailscale status

Then look at your tailnet’s access controls in the admin console. If a guest device or a shared box shouldn’t use your models, tag it and write a rule for that.

4. Start clean if you need to

tailscale serve reset

That clears all the Serve config on this machine. Only run it if you know nothing else depends on it.

My take

Sharing a model across the tailnet is great. Sharing it with the whole internet by accident is not. Five minutes now saves a surprise bill or a stranger using your GPU.

God Bless, and May the Source Be with You!

References & Further Reading

• Omarchy 4.6 will let you share a local AI model across your tailnet (Omarchy Central)
• Tailscale Serve (Tailscale Docs)
• Tailscale Funnel (Tailscale Docs)
• How-To: Tighten Tailscale SSH rules (EtherNinja)