Setup: Home Assistant + Caddy in Docker on a Mac mini at home. Caddy serves only /api/* on the Mac's Tailscale IP, port 8443. Tailscale ACL allows my Muse agent's VM to that port. Goal: let the agent query the HA API remotely.
What's verified:
• Mac mini is on the tailnet, Tailscale running, peer visible in tailscale status from the agent VM
• Caddy serves the API locally (gets expected 401 without token)
• Lutron/Ring integrations healthy in HA
What fails: every request from the agent VM through Muse's documented tunnel path (HTTP proxy with CONNECT, port 3130) to https://<tailnet-ip>:8443/api/ dies with curl exit 52, "Empty reply from server" — in about 8 seconds, never a proxy error, never a timeout waiting on approval. A stale duplicate node entry in the peer list just times out (exit 28), so that's not it either.
This smells like the agent platform's tunnel data plane never passing the traffic, not a Tailscale or HA misconfig — but before I write it off, has anyone here actually gotten a Muse agent VM talking to a tailnet peer? Or found a workaround that doesn't involve exposing things publicly (Funnel/Cloudflare Tunnel/ngrok are the obvious fallbacks)?