A road home: Tailscale.

Said and Done. answers only on your own machine —127.0.0.1:5180 — and never opens itself to the internet. Tailscale takes the most private route of the three: your computers and your phone join one small network of their own, and the desk becomes reachable inside it — with no public URL anywhere. Install Tailscale on the desk machine and on your phone, sign both into the same account, and pick a road.

1 · Arm the Remote Client

In the app: Settings → Connections → Remote Client → Set up…. Choose a password — that alone arms it, and on a tailnet that is genuinely enough: nobody outside your devices can even knock. When the row says it is listening on 127.0.0.1:5180, you are ready.

2 · Your devices only

tailscale serve --bg --https=443 localhost:5180

That serves the desk over HTTPS at your machine's own tailnet name —https://your-machine.your-tailnet.ts.net — visible to your devices and to nothing else on Earth. --bg keeps it running after you close the terminal. Tailscale's HTTPS certificates need enabling once in its admin console; the CLI tells you if they aren't yet.

3 · Or the public road

tailscale funnel 5180

Funnel is the same address, opened to the public internet — for the day you want to reach the desk from a machine that isn't yours. The same port can't ride serve and Funnel at once; pick the road you mean. Behind Funnel, treat the URL like any public door: a real password, and the one-time code on top.

4 · From your phone

With Tailscale running on the phone, open your machine'sts.net URL and sign in. The record, the case files, search, and the Page sheets are all there, sized for a thumb. Files you attach from the phone land in the desk's own attachment store, on the computer where the app runs.