M.2 UPS PMH Web Panel V02 — private Internet access
Pi Modules Technologies L.P. | https://www.pimodules.com

1. Keep stable cable power and Internet connected to Raspberry Pi 5.
2. Extract M2_UPS_PMH_WebPanel_V02.zip in your home directory.
3. Install/upgrade the panel and add Tailscale:
   cd ~/M2_UPS_PMH_WebPanel_V02
   sudo python3 install_webpanel.py --with-tailscale
   Existing panel accounts/passwords are retained. A new installation asks for
   a visible administrator password (at least eight characters, entered twice).
4. Open the official Tailscale authorization link printed in SSH, using a
   browser on your computer or phone. Sign in to your chosen Tailscale account
   and authorize this Pi. Account/device approval may also be required by your
   network administrator. No Tailscale password/auth key is stored in this ZIP.
   If authorization takes longer than 45 seconds, the local panel remains
   installed. Finish with: sudo tailscale up
5. Install the official Tailscale application on Android, iOS, Windows or Linux:
   https://tailscale.com/download
   Sign in to the SAME Tailscale network and connect its VPN.
6. Get the Pi's private address:
   tailscale ip -4
   Open http://<that-address>:8080 in your phone/computer browser.
   This is the Pi's address, not the phone's. Example: http://100.101.102.103:8080
7. Sign in to the panel as admin (or your viewer account), with its existing
   panel password. The Tailscale login does not replace the panel login.
8. For a real remote test turn off phone Wi-Fi, keep mobile data and Tailscale
   connected, and open the same Pi address. Confirm live status before writing
   settings. Existing cable/firmware/confirmation guards still apply.

If the panel is already installed:
   sudo python3 install_webpanel.py --tailscale-only
This does not reinstall the panel, alter accounts or access UPS registers.
Normal installation without either flag remains local-only.

Check:
   sudo python3 install_webpanel.py --check
   tailscale status
   tailscale ip -4
   sudo journalctl -u tailscaled -b -n 30 --no-pager
The check displays the private URL if connected. It does not prove that a
remote phone has access; test from that phone. Only IPv4 addresses are used
by the supplied instructions. Access by MagicDNS/FQDN is not configured;
use the numeric Tailscale IP to match the panel Host-header protection.

If connection fails, verify that both devices are online and in the same
Tailscale network, the Pi is authorized/approved, and the network policy and
any existing firewall permit access to the Pi TCP port 8080. This installer
changes neither firewall rules nor tailnet access policy. Existing Tailscale
preferences are not reset; if tailscale up asks for existing flags, review its
message rather than using --reset blindly. Reauthenticate expired devices via
Tailscale. Key-expiry settings remain unchanged.

Security and operation:
The panel continues listening locally on port 8080. Traffic sent to its private
Tailscale address traverses the encrypted VPN. The local LAN URL is ordinary
HTTP. Do not forward port 8080 on your router. This package does not enable
Tailscale Funnel, public hosting, an exit node, subnet routing or Tailscale SSH.
The default Tailscale network policy may allow other members to reach the Pi;
use trusted members/policy and the separate panel accounts appropriately.
No router configuration or public IP is required for this workflow.
Linux tailscaled is enabled at boot. Internet connectivity is required on both
ends. Tailscale is a third-party service with its own terms and plan limits;
check them for commercial/customer deployments.

Automatic installation adds the official signed Tailscale apt repository on
Debian/Raspberry Pi OS bookworm/trixie. It does not execute a downloaded shell
script. For other operating systems use the official installation instructions.
An existing repository configuration is never overwritten: if installation
stops there, review it, run sudo apt-get update and sudo apt-get install tailscale,
then retry --tailscale-only. Interrupted apt downloads can be retried normally.
If remote setup fails after panel installation, local panel/accounts remain.
Uninstalling the panel retains Tailscale intentionally; it may serve other
applications. To disconnect the Pi from Tailscale separately: sudo tailscale down
Do not do this over your only remote connection.

Official references (reviewed 25 October 2026):
https://tailscale.com/docs/install/linux
https://pkgs.tailscale.com/stable/
https://tailscale.com/docs/reference/tailscale-cli/up
https://tailscale.com/docs/how-to/run-unattended

Validation: automated subprocess/network simulations only; live Tailscale
pairing and remote phone access must be tested on your Pi. MCU firmware,
bootloader, shutdown daemon and register map remain V8B5 and unchanged.
