`npx run dev --env=dev --remote` does not work at all with tailscale

[Peru-S]

What versions & operating system are you using?

Wrangler 4.78.0 / Ubuntu 24.04
tailscale 1.96.2

Please provide a link to a minimal reproduction

NA

Describe the Bug

Prior versions of npx wrangler dev (prior to I guess wrangler 4?), local mode at least worked. Now it completely borks on a very common scenario: Ubuntu with tailscale running.

• I installed tailscale but did not run tailscale serve (ensured tailscale serve --status returns No serve config)

Command:

npx dev --env=dev --remote

(Note without --remote, it works but it's useless because I don't have WAE etc setup for local)

Access: http://localhost:8989/ and the following error/crash occurs:

✘ [ERROR] e = kj/compat/tls.c++:256: failed: TLS peer's certificate is not trusted; reason = Hostname mismatch

  stack:
  stack:
  /home/x/repo/sites/node_modules/@cloudflare/workerd-linux-64/bin/workerd@33d4080
  /home/x/repo/sites/node_modules/@cloudflare/workerd-linux-64/bin/workerd@33d4641
  /home/x/repo/sites/node_modules/@cloudflare/workerd-linux-64/bin/workerd@5008928
  /home/x/repo/sites/node_modules/@cloudflare/workerd-linux-64/bin/workerd@33db620
  /home/x/repo/sites/node_modules/@cloudflare/workerd-linux-64/bin/workerd@5034770
  /home/x/repo/sites/node_modules/@cloudflare/workerd-linux-64/bin/workerd@5034a20
  /home/x/repo/sites/node_modules/@cloudflare/workerd-linux-64/bin/workerd@50178a0
  /home/x/repo/sites/node_modules/@cloudflare/workerd-linux-64/bin/workerd@360b8c7
  /home/x/repo/sites/node_modules/@cloudflare/workerd-linux-64/bin/workerd@360c809
  /home/x/repo/sites/node_modules/@cloudflare/workerd-linux-64/bin/workerd@360fbdb
  /home/x/repo/sites/node_modules/@cloudflare/workerd-linux-64/bin/workerd@35eaea0
  /home/x/repo/sites/node_modules/@cloudflare/workerd-linux-64/bin/workerd@35f1d40
  /home/x/repo/sites/node_modules/@cloudflare/workerd-linux-64/bin/workerd@3608580
  /home/x/repo/sites/node_modules/@cloudflare/workerd-linux-64/bin/workerd@1f5f1d0
  /home/x/repo/sites/node_modules/@cloudflare/workerd-linux-64/bin/workerd@2df0fa0
  /home/x/repo/sites/node_modules/@cloudflare/workerd-linux-64/bin/workerd@2ae6930;
  sentryErrorContext = jsgInternalError; wdErrId = qr0ssegff5c96prtr8637oqm

This is a serious regression in the wrangler dev from prior versions. I can't test a simple WAE-related change locally without deploying to test/prod (!)

I realize there is some obscure workaround elsewhere if I search for this TLS error, but none of them work for me, and I should not have to jump through hoops to run a simple dev server.

Astro, other dev servers, 'just work' with tailscale or not.

Please provide any relevant error logs

No response

[petebacondarwin]

This was my suggestion from when you reported this in January (#12308):

---

Tailscale has a built-in feature called Tailscale Serve that solves exactly this problem. It will generate a legitimate, public-trusted Let's Encrypt certificate for your Tailnet machine name and terminate the SSL for you.

You don't need to change your Wrangler config:

1. Run Wrangler normally (on HTTP is fine, or HTTPS):

npx wrangler dev
# Assuming it starts on port 8787

2. In a new terminal window, tell Tailscale to front it:

tailscale serve https / http://127.0.0.1:8787

What happens:

• Tailscale grabs a real certificate for machine-name.tail-net.ts.net.
• You visit https://machine-name.tail-net.ts.net in your browser.
• Result: Valid Green Lock. No errors. Tailscale decrypts the traffic and passes it to your local Wrangler instance.

[petebacondarwin]

But now you are saying that you want to run wrangler dev --remote and that this is to test WAE( not sure what this stands for?).

I think that the approach above could still work since you would be connecting to a local Wrangler that then proxies to the remote preview.

Also, you could try doing a "wrangler version upload" in order to upload a "production-ready" instance of the Worker but not actually deploy it, so that it is not yet in production.

[Peru-S]

Hi,
I tried tailscale serve already, that had the exact same problem.
wrangler dev --remote simply is not working with tailscale.

I would guess a large proportion of your users would be using tailscale as it's really commonplace now. So workarounds such as wrangler version upload are not optimal.

WAE = Workers Analytics Engine

[Peru-S]

This was my suggestion from when you reported this in January (#12308):

The LLM response (from the original issue and here) was not helpful btw - I did ask my local LLM before opening the first issue; its simply expected of users now. Sorry forgot to reply to that issue.

[petebacondarwin]

I would guess a large proportion of your users would be using tailscale as it's really commonplace now.

Interestingly you are the only user that has reported this issue.

I am confident that no version of Wrangler would have supported this out of the box for --remote mode dev since they all would have had problems with untrusted local certificates. Can you tell me for what version of Wrangler this works?

[Peru-S]

The version of wrangler I had before this --remote flag was added: I believe before the OSS workers integration (I think?). I remember I didn't have to do anything before.

Simple things no longer work (that used to work before - in the pre-workers-sdk? release):
(a) Make changes to the source & reload the page (Astro). Now I have to restart wrangler. It used to be automatic.
(b) Accessing from any other machine on the LAN (so it's not strictly bound to localhost). (Regardless of tailscale presence)

So a bunch of broken/regressed features (in addition to just not working at all with tailscale) with the new version (since Nov/Dec-ish?). I have had to use the Astro fallback (and cross fingers) or other hacky things.

It feels broken/untested etc. I am surprised others haven't hit these?