OpenClaw Version: v2026.3.23-2
Platform: Linux (macOS Mac Mini host)
Issue Type: Regression

Problem

After upgrading to OpenClaw v2026.3.23-2, Control UI is no longer accessible via Tailscale Serve HTTPS reverse proxy.

Symptoms

• Gateway active and working locally
• Tailscale Serve configured: https://mac2-macmini.tail14a6bf.ts.net → http://127.0.0.1:18789
• Remote browser access (Windows/Android on Tailnet) → repeated WebSocket error

Gateway logs:

[ws] closed before connect ... code=4008 reason=connect failed
Forward IP: 100.117.197.66
Origin: https://mac2-macmini.tail14a6bf.ts.net

Configuration

"gateway": {
  "port": 18789,
  "mode": "local",
  "bind": "all",
  "controlUi": {
    "allowInsecureAuth": true,
    "allowedOrigins": ["https://*.tail14a6bf.ts.net"]
  },
  "auth": {
    "mode": "token",
    "allowTailscale": true,
    "skipAuth": ["127.0.0.1", "::1", "100.117.197.66"],
    "token": "<redacted>"
  },
  "tailscale": {
    "hostname": "mac2-macmini"
  },
  "trustedProxies": ["127.0.0.1"]
}

Tailscale Serve:

$ tailscale serve status
https://mac2-macmini.tail14a6bf.ts.net (tailnet only)
|-- / proxy http://127.0.0.1:18789

Behavior

• ✅ Previous versions (2026.3.13 or earlier): WebSocket upgrade worked via Tailscale Serve
• ❌ Current version (2026.3.23-2): WebSocket fails with code=4008 reason=connect failed

Workarounds Tested

1. SSH Tunnel: Works but inconvenient for mobile access
2. Direct IP HTTP: Fails with "device identity required" (secure context needed)
3. skipAuth for remote IP: Doesn't help (WebSocket still fails)

Root Cause (suspected)

OpenClaw 2026.3.23-2 may have introduced stricter WebSocket upgrade requirements that are incompatible with Tailscale Serve HTTPS proxying.

Request

Please verify WebSocket upgrade compatibility with HTTPS reverse proxies (specifically Tailscale Serve) and restore functionality present in earlier versions.

Additional Info

• Client User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0
• Tailscale version: (can provide if needed)
• Config file: /root/.config/openclaw/openclaw.config.json5

Priority: High - blocks remote Control UI access for Tailscale setups (common in self-hosting)