Calls

Calls over your tailnet

If the runtime host and the device you call from are on the same Tailscale network, the call needs no hosted relay. Sleeptalk publishes its local call server under the host's tailnet name, at https://<host>.<tailnet>.ts.net:8443/.

Enable HTTPS certificates once per tailnet

Turn on HTTPS certificates under DNS in the Tailscale admin console. Browsers only allow the microphone on HTTPS.

Allow serve once per host

Install Tailscale and sign in. On Linux, let your user configure serve without sudo with sudo tailscale set --operator=$USER.

Choose the tailnet

Setup asks once, when Tailscale is ready, whether to deliver browser calls over your tailnet. You can also select Your tailnet under Call delivery on the settings page, or run sleeptalk host ensure --profile default --tailnet. Each writes the profile setting below.

Profile setting

[transport.options]
delivery = "tailnet"

For one call only, add --tailnet:

Start one tailnet call

sleeptalk host start-voice --profile default --tailnet --json

For each call, Sleeptalk runs tailscale serve --bg --https=8443 against its own loopback port and turns that entry off when the call ends or sleeptalk host stop runs. It uses port 8443 so nothing else you serve on 443 is touched. It never uses tailscale funnel, which would expose the call server publicly.

If Tailscale is not ready, the start fails before any link is created. The hosted relay is never a silent fallback.

Receipt code	Fix
`tailscale_missing`	Install Tailscale and sign in.
`tailscale_not_running`	Run `tailscale up`.
`tailscale_https_disabled`	Enable HTTPS certificates in the admin console.
`tailscale_operator_required`	Run `sudo tailscale set --operator=$USER`.
`tailscale_serve_failed`	Check `tailscale serve status` on the host.

The details and field evidence are in tailnet calls.