docs: remote access targets Starfire over Headscale; mark verified, reported and unverified (Meta 2026-11-06)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs/remote-access.md

@@ -1,15 +1,38 @@
 # Remote access: iPad to a Sunshine host on restrictive wifi
 
-**Status: planning document. Every step below is untested.** Nothing here has been run
-against the real host, iPad, or network. Doc claims are cited; anything not found in the
-cited docs is marked *unverified*. Nothing in this repo changes: this is a design note.
+**Status: partly verified, mostly planning.** Corrected per Meta, 2026-11-06. Steps and
+claims not listed under "Verified" below are untested; anything not found in the cited
+docs is marked *unverified*. Nothing in this repo changes: this is a design note.
+
+## Verified (Meta, 2026-11-06)
+
+- The Sunshine host is **Starfire**, not Raven. Raven is Deru's gaming machine and is not
+  involved.
+- Moonlight on **Periwinkle** reaches Sunshine on Starfire. This is a working client and
+  host pair; nothing below has been re-run by a Mind.
+- The mesh is **Headscale on Yggdrasil**, not Tailscale's hosted control plane. Option A
+  (hosted Tailscale) is kept below as reference only and is not the plan.
+
+## Reported, not verified
+
+- Starfire's GPU is a GTX 1070 (NVENC encode). Reported, not checked; no Mind probed
+  Starfire for this note.
+
+## Unverified (do not rely on)
+
+- **Remote access from outside the home network.** Nothing shows a stream working from
+  another network, over the mesh or otherwise.
+- **The iPad joining the mesh** (see Client device: no App Store, Taurine, TrollStore).
+- **A Starfire desktop session.** Whether a logged-in desktop exists for Sunshine to
+  capture when nobody is at the machine is not established (the Minds' accounts there have
+  no desktop; Starfire also runs unattended and may be down).
 
 ## Conditions in force
 
 Set by Eureka (who holds the Wireguard network and Yggdrasil). They bound every option
 below; an option that cannot meet them is out.
 
-- **Raven's Sunshine host is a yes in principle only if** it is bound to the Wireguard
+- **Starfire's Sunshine host (these conditions were set when Raven was assumed to be the host; they carry over until Eureka says otherwise) is a yes in principle only if** it is bound to the Wireguard
   interface and paired by Meta, and never exposed (no public or LAN-wide listener, no
   port forward). *Untested and unverified: how to bind Sunshine to one interface. This
   doc has not found a Sunshine setting for it; check the Sunshine configuration page and
@@ -36,7 +59,7 @@ through TrollStore, not the App Store. Consequences, none of them tested:
 
 ## Problem
 
-Moonlight (this client) streams from a Sunshine host (called **Raven** here) over several
+Moonlight (this client) streams from a Sunshine host (**Starfire**) over several
 TCP and UDP ports. The target situation is an iPad on managed wifi that blocks those
 ports, with no mobile data fallback. The usual escape is an overlay VPN whose traffic
 looks like ordinary HTTPS. Only outbound TCP 443 is assumed to work.
@@ -56,7 +79,7 @@ Moonlight video/audio/input are UDP. Tailscale and Headscale carry arbitrary IP
 WireGuard, so UDP flows unchanged. When no direct path exists, the WireGuard packets
 travel inside a TCP/HTTPS connection to a DERP relay.
 
-## Option A: Tailscale (hosted control plane, Tailscale DERP)
+## Option A: Tailscale (hosted control plane, Tailscale DERP) - reference only, not the plan
 
 ### How it behaves on a 443-only network
 
@@ -74,16 +97,16 @@ travel inside a TCP/HTTPS connection to a DERP relay.
 ### Steps (all untested)
 
 1. Create or identify the tailnet and its owner (see Open Questions).
-2. Install Tailscale on Raven; sign in to that tailnet.
+2. Install Tailscale on Starfire; sign in to that tailnet.
 3. Install a Tailscale client on the iPad (no App Store there; see Client device); sign in to the same tailnet. *Unverified:
    whether the managed iPad's profile permits installing a VPN app or creating a VPN
    configuration. This is the first likely blocker.*
-4. In the Tailscale admin console or `tailscale status` on Raven, note Raven's tailnet IP
+4. In the Tailscale admin console or `tailscale status` on Starfire, note Starfire's tailnet IP
    (`100.x.y.z`) or MagicDNS name.
-5. On the LAN beforehand if possible, pair Moonlight with Raven normally. If pairing over
+5. On the LAN beforehand if possible, pair Moonlight with Starfire normally. If pairing over
    the tailnet: in Moonlight, add the host manually by tailnet IP; enter the PIN in
    Sunshine's web UI.
-6. Start a stream over the tailnet; check with `tailscale ping raven` (on any tailnet
+6. Start a stream over the tailnet; check with `tailscale ping starfire` (on any tailnet
    device) whether the path is `direct` or `via DERP(...)`.
 7. If relayed and unplayable, lower Moonlight resolution, FPS and bitrate first.
 
@@ -94,7 +117,7 @@ extra round trip through the nearest DERP region, and a throughput ceiling. Expe
 playable desktop and slow-paced use, not guaranteed competitive-game latency. *No
 measurement exists for this site; measure with `tailscale ping` and a trial stream.*
 
-## Option B: self-hosted Headscale on Yggdrasil behind 443
+## Option B: self-hosted Headscale on Yggdrasil behind 443 - this is the mesh in use
 
 Headscale is an open-source reimplementation of the Tailscale control server; the
 official Tailscale iOS app can point at it
@@ -103,7 +126,9 @@ official Tailscale iOS app can point at it
 
 ### Needs Eureka's approval first
 
-Nothing below is done until Eureka approves each item:
+Headscale on Yggdrasil exists (Meta, 2026-11-06). Its public hostname, TLS, relay choice and
+node registration were not checked for this note, so each item below is still a question to
+Eureka, not a settled fact:
 
 - A new public hostname and DNS record for the control server.
 - A public TLS certificate for it, and where TLS terminates.
@@ -146,21 +171,21 @@ before use, per [config docs](https://headscale.net/stable/ref/configuration/))
 ### Exposure added
 
 One new public HTTPS hostname fronting a control plane; optionally a public relay and UDP
-3478. Raven and the iPad gain no inbound ports; Sunshine ports stay on the tailnet. The
-tailnet's ACLs should restrict the iPad to Raven's Moonlight ports only
+3478. Starfire and the iPad gain no inbound ports; Sunshine ports stay on the tailnet. The
+tailnet's ACLs should restrict the iPad to Starfire's Moonlight ports only
 (*unverified in this environment; ACL syntax differs between Headscale versions*).
 
 ## Failure ladder
 
 Run top to bottom, stopping at the first success. Everything is untested.
 
-1. Home/LAN: confirm Moonlight streams to Raven with no overlay (baseline).
+1. Home/LAN: confirm Moonlight streams to Starfire with no overlay (baseline).
 2. Tailscale on both devices at the LAN: confirm tailnet IP works, `tailscale ping` is
    direct.
 3. iPad on the restrictive wifi, Tailscale connected: does the app reach "Connected"?
    If not: is VPN installation or profile blocked by management (stop; this is policy,
    not network), or is 443 to the control plane filtered or TLS-intercepted?
-4. `tailscale ping raven` from the iPad's side (use another tailnet device, or app
+4. `tailscale ping starfire` from the iPad's side (use another tailnet device, or app
    status): `direct` is best, `via DERP` means relay.
 5. Relayed but stream stutters: lower bitrate, resolution, FPS; try H.264 over HEVC if the
    iPad decoder is struggling (decode, not network, may be the limit).
@@ -180,11 +205,11 @@ Run top to bottom, stopping at the first success. Everything is untested.
 | Control-plane ownership | Tailscale account holder | Eureka / GameCult |
 | Latency when relayed | Tailscale DERP regions | Same, or own DERP region if run |
 | Ongoing work | None | Upkeep, updates, backups |
-| Recommended | Try first | Only if A fails at ladder step 3 or 6 |
+| Recommended | Not the plan (mesh is Headscale) | The mesh in use |
 
 ## Open Questions
 
-- Where does Raven sit on the network (same LAN as the iPad's home, behind carrier NAT,
+- Where does Starfire sit on the network (same LAN as the iPad's home, behind carrier NAT,
   behind a router that can forward ports, wired or wifi)? It decides whether direct
   connections are plausible at all.
 - Who holds the tailnet account for Option A (individual, org, shared), and who can add