Deploy on the spare laptop (the always-on home)

Goal: the Aquila stack (manager + gateway + bots) moves from the dev machine to your spare laptop, which stays on 24×7. The relay VPS stays a dumb TLS pipe — all data lives on the laptop.

Why a relay at all (your question, answered)

DNS needs a public address. The laptop is behind NAT (its 10.10.10.23 is private; Tailscale addresses are private too). So: *.aquila.exaflair.com → relay VPS public IP → Caddy → a tunnel the laptop itself opens outbound → laptop's manager. The relay never stores anything; it's a doorbell, not a house.

What's needed from you

  1. The laptop online with Tailscale up. Right now I can't reach it: 10.10.10.23 times out and tailscale status doesn't list cnsku-18 (I see cnsku-19-1, node-b, node-b2). Check on the laptop: tailscale status → if it's not listed/logged in, run tailscale up. Then tell me its tailnet name or IP (e.g. cnsku-18-1 100.x.y.z).
  2. Docker + compose installed (same as we used here). Check: docker --version && docker compose version.
  3. Sudo for installing one systemd unit (the tunnel) — or you run one command I'll paste.

What I do then (30–45 minutes, no further asks)

  1. Copy the repo + .env over Tailscale; docker compose build && up -d.
  2. Build the core image; create your first real bot; wire the tunnel: laptop → relay:127.0.0.1:8090 (autossh systemd unit, restricted key on the relay).
  3. Add the wildcard DNS (2-min guide) and watch the first <number>.aquila.exaflair.com certificate issue itself.
  4. Run the full smoke: welcome → OTP → bot chat → routine delivery, from your phone.

Safety notes