Environment

• OpenClaw version: 2026.6.10 (aa69b12)
• iOS app version: Day-1 public release (2026-06-30)
• Device: iPhone 13 mini, iOS 26.5.0
• Gateway host: macOS (Mac mini, Apple M4 Pro)
• Tailscale version: 1.98.3 (client) / 1.98.5 (server)
• Install: Homebrew

Summary

The iOS app cannot connect to a gateway over Tailscale CGNAT addresses (100.x.x.x) or Tailscale Serve (wss://hostname.ts.net). The app requires wss:// for non-LAN addresses (correct), but every wss:// path we attempted silently drops the WebSocket upgrade — HTTP works but the WebSocket handshake never completes.

Steps to reproduce

1. Gateway running on macOS with gateway.bind=tailnet (Tailscale IP: 100.125.45.28)
2. iPhone on 5G (Tailscale active, phone IP 100.75.182.44, ping round-trip confirmed working)
3. Safari on iPhone → https://100.125.45.28:18789/health returns {"ok":true} ✅
4. iOS OpenClaw app → Gateway settings → Host: 100.125.45.28, Port: 18789, TLS: ON → Connect Manual
5. App shows Waiting for gateway indefinitely. No connection attempt reaches gateway logs.

Tailscale Serve path (also tried)

1. gateway.bind=loopback, gateway.tailscale.mode=serve
2. tailscale serve --bg http://localhost:18789 → https://uday-one-1.tail5d3585.ts.net live
3. openclaw qr --json → wss://uday-one-1.tail5d3585.ts.net ✅
4. Safari on iPhone → https://uday-one-1.tail5d3585.ts.net/health → {"ok":true} ✅
5. WebSocket upgrade test from gateway host: Tailscale Serve returns HTTP/2 200 instead of 101 Switching Protocols — Tailscale Serve silently drops WebSocket upgrades
6. iOS app shows Reconnecting... indefinitely. Zero connection attempts in gateway logs.

Native gateway TLS path (also tried)

1. gateway.bind=tailnet, gateway.tls.enabled=true, cert/key from Caddy local CA
2. Caddy root CA cert installed + trusted on iPhone (Certificate Trust Settings → full trust enabled)
3. https://100.125.45.28:18789/health → 200 ✅ from iPhone Safari on 5G
4. iOS app → TLS handshake failed (app rejected cert silently)
5. Switched to leaf cert — app showed Verify gateway TLS fingerprint screen but fingerprint prompt never appeared for user to confirm
6. Reverted — native TLS broke local CLI tools (loopback ws:// vs wss:// mismatch)

What does work

• ✅ iPhone connected successfully over LAN (ws://192.168.0.117:18789, gateway.bind=lan) on first attempt
• ✅ Tailscale tunnel confirmed working in both directions (ping, Safari HTTP)
• ✅ openclaw qr --json correctly advertises wss:// endpoint when Tailscale Serve is active
• ❌ WebSocket upgrade never completes over any Tailscale path

Expected behaviour

iOS app should be able to connect to gateway over Tailscale (either CGNAT direct or via Tailscale Serve) using wss://. HTTP reachability is confirmed — the WebSocket upgrade is the specific failure point.

Related issues

• WebSocket upgrade fails via Tailscale Serve HTTPS proxy (v2026.3.23-2 regression) #54008 — WebSocket upgrade fails via Tailscale Serve (still open, similar but not iOS-specific)
• [Bug]: iOS LAN gateway connects are forced to wss, and bootstrap-only setup codes fail onboarding #47887 — iOS LAN gateway forced to wss (partially fixed in #36df0d9, but Tailscale CGNAT still fail-closed)
• PR fix(ios): allow plaintext ws:// for LAN/Tailscale hosts; prefer password over bootstrap token (#47887) #65185 — Fix attempted but security review blocked Tailscale CGNAT plaintext allowance

Notes

The iOS app README says super-alpha and internal-use only — understood. Filing this to track the Tailscale remote pairing gap now that the app is publicly released. The LAN path works cleanly; the remote/Tailscale path needs attention.