First-run LLM auth and phone access verification over Tailscale #54

New issue

Open

opened 2026-08-22 20:52:17 +00:00 by lab · 0 comments

lab commented

2026-08-22 20:52:17 +00:00

Owner

End-to-end bring-up of the deployed OpenCode server: provider auth once, then
verify real usage from a phone over Tailscale. Requires the K3s deployment
issue to be done.

Tasks

One-time LLM provider auth, persisted into the PVC state mount:

```bash
kubectl -n opencode exec -it deploy/opencode -- opencode auth login
```

Survives pod restarts and image bumps because
`~/.local/share/opencode/auth.json` lives on the PVC.

Laptop check: log into http://192.168.0.225:4096 in a browser with
the basic-auth credentials.

Phone check (iPhone iphone173, tailnet maestro00@):

1. Enable Tailscale, confirm the router subnet route is active
2. Open `http://192.168.0.225:4096`, pass basic auth
3. Send a test prompt, e.g. "list the repos in /workspace and run
   git status in homelab"

Verify agent round-trip through Forgejo: ask it to make a scratch
change on a throwaway branch in /workspace/homelab and push it;
confirm the branch appears in Forgejo, then delete it.
Optional: attach the desktop TUI to the same server and confirm shared
sessions: opencode attach http://192.168.0.225:4096
Add a phone home-screen bookmark for the URL.

Acceptance criteria

A prompt sent from the phone produces real work in /workspace/homelab
and a pushed branch in Forgejo
Sessions survive a rollout restart of the deployment
No public exposure: everything above fails with Tailscale disabled

Depends on #53.

End-to-end bring-up of the deployed OpenCode server: provider auth once, then verify real usage from a phone over Tailscale. Requires the K3s deployment issue to be done. ## Tasks - [ ] One-time LLM provider auth, persisted into the PVC state mount: ```bash kubectl -n opencode exec -it deploy/opencode -- opencode auth login ``` Survives pod restarts and image bumps because `~/.local/share/opencode/auth.json` lives on the PVC. - [ ] Laptop check: log into `http://192.168.0.225:4096` in a browser with the basic-auth credentials. - [ ] Phone check (iPhone `iphone173`, tailnet `maestro00@`): 1. Enable Tailscale, confirm the router subnet route is active 2. Open `http://192.168.0.225:4096`, pass basic auth 3. Send a test prompt, e.g. "list the repos in /workspace and run git status in homelab" - [ ] Verify agent round-trip through Forgejo: ask it to make a scratch change on a throwaway branch in `/workspace/homelab` and push it; confirm the branch appears in Forgejo, then delete it. - [ ] Optional: attach the desktop TUI to the same server and confirm shared sessions: `opencode attach http://192.168.0.225:4096` - [ ] Add a phone home-screen bookmark for the URL. ## Acceptance criteria - A prompt sent from the phone produces real work in `/workspace/homelab` and a pushed branch in Forgejo - Sessions survive a `rollout restart` of the deployment - No public exposure: everything above fails with Tailscale disabled Depends on #53.