Run byre and the app on their own embedded Tailscale nodes

api/openapi.yaml

@@ -720,8 +720,8 @@ paths:
     get:
       operationId: listPreviews
       description: >
-        The ports the task's agent exposed with expose_port, by name. Each is served by tailscale serve on the same
-        port number of byre's host, over HTTPS, until the task is merged or discarded.
+        The ports the task's agent exposed with expose_port, by name. Each is served on the same port number of
+        byre's tailnet node, over plain HTTP, until the task is merged or discarded.
       responses:
         "200":
           description: The previews.
@@ -1139,6 +1139,19 @@ paths:
             application/json:
               schema: { $ref: "#/components/schemas/Status" }
 
+  /api/tailnet:
+    get:
+      operationId: getTailnet
+      description: >
+        The state of byre's own tailnet node. It is the only request byre answers on its loopback address, where it
+        needs no identity, so the app on the same Mac can sign the node in before it is reachable on the tailnet.
+      responses:
+        "200":
+          description: The node's state.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/Tailnet" }
+
   /api/admin/usage-commands:
     get:
       operationId: getUsageCommands
@@ -1642,9 +1655,18 @@ components:
       properties:
         task_id: { type: string }
         name: { type: string }
-        port: { type: integer, description: "A port in the task's block, served at https://<byre's host>:<port>/." }
+        port: { type: integer, description: "A port in the task's block, served at http://<byre's tailnet host>:<port>/." }
         created_at: { type: string, format: date-time }
 
+    Tailnet:
+      type: object
+      required: [state, auth_url, hostname, origin]
+      properties:
+        state: { type: string, description: "The node's backend state: NoState, NeedsLogin, NeedsMachineAuth, Stopped, Starting or Running." }
+        auth_url: { type: string, description: "The URL that signs the node in while it needs a login; empty otherwise." }
+        hostname: { type: string, description: The hostname the node asks the tailnet for. }
+        origin: { type: string, description: "byre's https origin on the tailnet, empty until the node has a certificate domain." }
+
     Review:
       type: object
       description: An agent session on the vendor the task's agent doesn't use, reviewing one snapshot's change.