openclaw - 💡(How to fix) Fix [Feature]: Support Tailscale Serve `--service` for ControlUI exposure [1 pull requests]

Summary

Allow OpenClaw's existing Tailscale Serve Control UI exposure feature to use Tailscale's --service option, so the ControlUI can be exposed under a stable service name instead of being tied to the device's default hostname.

Problem to solve

OpenClaw already supports exposing the Control UI via Tailscale Serve.

However, with the current behavior, the exposed URL is based on the machine's default Tailscale device name. This is not always ideal:

• The device name may be a generic initial setup name.
• The device name may change later.
• The hostname may not clearly describe that the exposed endpoint is the OpenClaw Control UI.
• Users may want a stable, purpose-specific endpoint name for OpenClaw without renaming the entire Tailscale device.

Tailscale Serve supports the --service option, which allows a service-specific name to be used. Supporting this in OpenClaw would make the built-in ControlUI exposure feature more flexible and easier to operate.

Proposed solution

Add support for configuring a Tailscale Serve service name when exposing the Control UI.

For example, OpenClaw could allow users to specify something like:

tailscale:
  serve:
    enabled: true
    service: svc:openclaw-controlui

or an equivalent setting in the existing configuration/UI.

When this option is set, OpenClaw should configure Tailscale Serve using a user-defined Tailscale Service identifier (for example svc:openclaw-controlui).

Expected behavior:

• Existing Tailscale Serve behavior remains unchanged by default.
• Users can optionally specify a service name for the ControlUI endpoint.
• The generated/displayed URL should reflect the service-based endpoint when configured.
• Funnel behavior should remain unchanged, since Tailscale Funnel does not appear to support the same --service option.
• Documentation should mention that this option applies to Serve only.

Alternatives considered

Rename the Tailscale device: This works, but it changes the identity of the entire machine. That is too broad when the user only wants a clearer endpoint for OpenClaw Control UI.

Keep using the default device hostname: This is simple, but it makes the Control UI URL depend on the machine name and can be confusing when the device name was chosen during initial setup.

Configure Tailscale Serve manually outside OpenClaw: This is possible, but it bypasses OpenClaw's existing Tailscale integration and adds manual operational steps.

Impact

Affected users:

• Users exposing OpenClaw Control UI through Tailscale Serve
• Self-hosted users who want a stable and descriptive ControlUI endpoint
• Users running OpenClaw on devices with generic or temporary Tailscale hostnames

Severity: Moderate. This does not block Control UI exposure, but it makes the published endpoint less ergonomic and harder to keep stable.

Frequency: Likely common for self-hosted users using the built-in Tailscale Serve feature.

Consequence: Users may need to rename the whole Tailscale device, remember unclear hostnames, or maintain manual Tailscale Serve configuration outside OpenClaw.

Evidence/examples

Tailscale Serve supports service-specific routing via the --service option.

This would allow OpenClaw Control UI to be exposed under a clearer name such as openclaw-controlui, instead of relying on the machine's default Tailscale hostname.

Additional information

The main goal is not to introduce Tailscale Serve support from scratch, since OpenClaw already has that capability. The request is specifically to make the existing ControlUI exposure feature support Tailscale's named service behavior.

This request intentionally does not include Funnel, because Tailscale Funnel does not appear to support the same --service option.