fix(t3-connect): serve Kamino T3 servers over Tailscale

[shunkakinoki]

Summary

• Kamino workers are linked publish-only, so the relay has no endpoint and "T3 Connect" entries fail with endpoint_provider_not_managed. The relay also caps managed tunnels at 3 per account, which rules out managed links for the fleet.
• Give every Kamino host a T3-service-owned Tailscale Serve route (443 -> 3773), so t3code.service runs with T3CODE_TAILSCALE_SERVE=true and clients pair through https://<name>.tail950b36.ts.net (t3 pair --tailscale).
• Add eval assertions for the kamino drop-in and document the client pairing flow.

Verification

• nix eval of homeConfigurations.kamino3 native-runtime.conf contains both env vars; kyber unchanged (8443).
• Applied live on kamino1-4 via a runtime drop-in: Tailscale Serve proxies 3773, tailnet URL returns 200, galactica paired and connected on all four.
• Full tests/eval.nix suite and shellspec not run locally.

🤖 Generated with Claude Code

---

Summary by cubic

Fixes T3 Connect failures on Kamino workers by serving the T3 server over Tailscale instead of the relay. Publish-only links have no relay endpoint (so entries fail with endpoint_provider_not_managed), and the relay caps managed tunnels at 3 per account.

• t3-connect now adds a t3-service-managed Tailscale Serve route (443 -> 3773) for Kamino hosts, running with T3CODE_TAILSCALE_SERVE=true and T3CODE_TAILSCALE_SERVE_PORT=443.
• Clients pair via t3 pair --tailscale at https://<name>.tail950b36.ts.net; the new README section and eval assertions cover the flow.

^{Written for commit 120c114. Summary will update on new commits.}

[indent]

Warning

This organization's free trial has ended, so Indent couldn't start this review. Manage billing to resume reviews on this repository.

[coderabbitai]

Warning

Review limit reached

Next included review available in 45 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 9ad1d24d-e58f-43cf-a368-43614ea0d4e0

📥 Commits

Reviewing files that changed from the base of the PR and between 6db3e16 and 120c114.

📒 Files selected for processing (3)

• home-manager/services/t3-connect/default.nix
• named-hosts/kamino/README.md
• tests/eval.nix

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[linear-code]

SHUN-6126

[pullfrog]

✅ No new issues found.

Reviewed changes

• home-manager/services/t3-connect/default.nix: Added Kamino-specific Tailscale Serve route configuration for the t3-service manager, enabling T3 Code to publish itself over Tailscale on port 443 → 3773 for Kamino workers.
• named-hosts/kamino/README.md: Added documentation for connecting clients to the T3 server via Tailscale Serve, including the pairing command and workflow.
• tests/eval.nix: Added assertions to verify that the T3CODE_TAILSCALE_SERVE=true and T3CODE_TAILSCALE_SERVE_PORT=443 environment variables are set in the systemd drop-in for Kamino hosts.

The changes correctly address the publish-only connectivity issue for Kamino workers by leveraging T3-service-owned Tailscale Serve routes, avoiding the relay's managed tunnel limitations. The implementation follows existing patterns and includes appropriate test coverage.

  ^{｜ View workflow run ｜ Using openrouter/openrouter/free ｜ 𝕏}