Family gets the photos, not the admin tools: a gateway built with Claude
Opening ports for family meant exposing every app on the server. In a few hours with Claude they wrote a tiny Go gateway that checks Tailscale, so each person reaches only what's shared with them.
Done withClaudeSpotted· by HN user shibel· Oct 15, 2026
Result No second login for the family
“I took a few hours with Claude back in January (?) and we wrote a tiny Go authorization gateway which basically consults both Tailscale’s public API and Tailscale’s `localapi` and returns the appropriate response to Caddy based on the requesting user’s actual allowed ports.”
Spotted: found in the wild. Details are as reported by the source above and have not been independently verified.
What they did
Shares self-hosted apps with family over Tailscale on custom domains. Opening the web ports for the host meant family could reach every app on it, including server admin tools. They spent a few hours with Claude writing a small Go authorisation gateway that checks Tailscale’s public API and local API and tells Caddy which apps each user may reach.
How it went
They can now share different apps with different people without giving up access control, all driven by Tailscale’s policy file, and without making family log in twice.
Try it yourself with Claude
I self-host several apps on one machine behind Caddy and share them with family over Tailscale. Write a small authorisation service that Caddy can call with forward_auth: look up the requesting Tailscale user, check whether my Tailscale policy lets them reach that app, and allow or deny. Include setup steps and tests for an allowed and a denied user.
A starting prompt written by Agents in the Wild. Fill in the [brackets], and check what the agent does before it sends, pays for or deletes anything.
An old printer stopped working with MacOS 27. Claude wrote new drivers, using its owner as eyes and hands: did grayscale work, did page 1 print at lower DPI, now reload the paper for duplex. Then it printed again.
Their Chromecast wouldn't connect to their IKEv2 home VPN from an Airbnb. Told to fix it, Claude found no way to make the existing VPN apps work, so it wrote a new client. About 20 minutes, plus their certs.
Devialet's official app was abandoned. Claude and Codex reverse engineered the amplifiers' private protocol and built an iOS controller in about a day of work. Without AI, they'd never have started.
A Santa hat, a hidden Bluetooth speaker and a cloned voice reading lines Claude wrote. At Christmas it sorted the kids, and declared a cheeky niece "Slytherin!!!"
Claude writes the story page by page, with the tension planned to peak in the middle, and Gemini draws it in a consistent style. Their kids love them night after night.
A Mac plus a Raspberry Pi speaker: wake word, web search, weather, Apple reminders, their own files and memory across sessions. And you can talk over it mid-reply to interrupt.