> american.legionpost194ga@gmail.com

● Good choice. All Phase E steps happen on the server (RDP).

  Step 1 — Sign up + install Tailscale

  1. On the server, open browser →
  https://login.tailscale.com/start
  2. Sign in with american.legionpost194ga@gmail.com. Accept the
   default tailnet name (you can rename later).
  3. Same browser → https://tailscale.com/download/windows →
  download and run the installer (defaults are fine).
  4. After install, in elevated PowerShell on the server:
  tailscale up
  4. It'll print a URL. Open it in the same browser, click
  "Connect" to authorize this server.
  5. Confirm:
  tailscale status
  5. Should show this machine with a 100.x.y.z IP.

  Step 2 — Configure the tailnet (in browser, admin console)

  These are one-time toggles for your tailnet:

  1. Go to https://login.tailscale.com/admin/dns → scroll to
  HTTPS Certificates → click Enable HTTPS.
  2. Go to
  https://login.tailscale.com/admin/settings/feature-flags →
  enable Tailscale Funnel if it's not already on.
  3. Go to https://login.tailscale.com/admin/acls → in the JSON
  editor, find or add the nodeAttrs block. Your full ACL should
  look something like:

  {
    "acls": [
      {"action": "accept", "src": ["*"], "dst": ["*:*"]}
    ],
    "nodeAttrs": [
      {"target": ["*"], "attr": ["funnel"]}
    ]
  }

  3. (Add a comma after the acls block before nodeAttrs if both
  are present.) Click Save.

  Step 3 — (optional) rename this server for a cleaner URL

  tailscale set --hostname=legion-checkbook

  That makes your public URL
  https://legion-checkbook.<your-tailnet>.ts.net instead of
  using the Windows hostname.

  Step 4 — Turn on Funnel for port 8765

  tailscale funnel --bg 8765
  tailscale funnel status

  The status command will print the public URL. It'll look
  something like:
  https://legion-checkbook.<random-name>.ts.net (Funnel on)
  |-- / proxy http://127.0.0.1:8765

  Copy that URL. That's your public login URL.

  Step 5 — Test it

  Open that HTTPS URL in your phone's browser (use cellular, not
   Wi-Fi, to confirm it's truly external). You should see the
  login page and be able to actually sign in this time — Secure
  cookie works because we're on HTTPS now.

  ---
  Tell me how each step goes. Most likely friction points:
  - Step 2 ACL JSON edit is the easiest place to mess up — if
  Funnel says "on" in step 4 but external requests fail, the ACL
   nodeAttrs is usually why.
  - If tailscale funnel --bg 8765 errors with "feature not
  available", the feature flag in step 2.2 isn't enabled yet.

  Paste the URL once Funnel is active and we'll move to Phase F
  (off-network test).

 tailscale funnel --bg 8765

PS C:\> tailscale funnel --bg 8765
tailscale : The term 'tailscale' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was
included, verify that the path is correct and try again.
At line:1 char:1
+ tailscale funnel --bg 8765
+ ~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (tailscale:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException