# Mesh VPN Setup — Android, VPS, and Home Desktop (Tailscale)

## Goal
Connect Android (roaming across 4G/5G) to the Ubuntu home desktop (behind an intranet/dynamic IP) using SSH, without relying on port forwarding or a fixed public IP on the home network. A VPS with a static IP is available as an optional jump host / extra node.

## Why Tailscale
- Creates a private mesh VPN between devices — no port forwarding needed.
- Each device gets a stable private IP (`100.x.x.x` range) that stays the same regardless of network (home wifi, mobile data, roaming).
- Built on WireGuard, but handles key exchange and NAT traversal automatically.
- Free for personal use up to a generous device limit.
- The VPS can also join the same Tailscale network as an extra always-on node if desired, though it's not required just to reach the home desktop.

## Devices in this mesh
- **Ubuntu home desktop** (Ubuntu 26.04, GNOME) — the machine being accessed
- **Android phone** — roams between mobile networks, used as the client
- **VPS** — has a static public IP, can act as a stable relay/jump host if needed

## Setup steps

### 1. Ubuntu home desktop
```
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
```
Authenticate via the URL it provides. Note the assigned Tailscale IP (`tailscale ip -4`).

### 2. Android
- Install **Tailscale** from the Play Store.
- Sign in with the same account used on Ubuntu.

### 3. (Optional) VPS
- Install Tailscale the same way as the Ubuntu desktop.
- Useful as a stable relay or backup access point, and as an SSH jump host if ever needed outside of Tailscale.

### 4. Connecting from Android
Using Termux or JuiceSSH:
```
ssh za@<ubuntu-tailscale-ip>
```
This works from any network the phone is on — no need to track the home intranet IP or deal with it changing.

## Fallback / alternative approaches considered
- **SSH reverse tunnel through VPS** (bastion approach): Ubuntu opens `ssh -R 2222:localhost:22 user@vps-ip -N` to the VPS, Android connects to `ssh za@vps-ip -p 2222`. Needs `autossh` or a systemd service to stay alive and reconnect. More manual than Tailscale, no separate app needed.
- **WireGuard via VPS**: manual VPN setup using the VPS as gateway. Tailscale is built on WireGuard and achieves the same result with far less configuration, so this was deprioritized in favor of Tailscale.

## Related context
- Chrome Remote Desktop was tried first but abandoned due to a persistent PIN/download access loop; it was uninstalled (`sudo systemctl stop/disable`, then `sudo apt purge chrome-remote-desktop`, config cleanup, `apt autoremove`).
- RustDesk was considered as a graphical remote-desktop alternative (open-source, TeamViewer-like, optional self-hosted relay) but SSH-based access via Tailscale was the direction being pursued for terminal access.
- SSH server setup on Ubuntu: `sudo apt install openssh-server && sudo systemctl enable --now ssh`.