Hi HN — I make MyLLM, a small iOS agent that talks to your own local model (Ollama/LM Studio) or runs fully offline. The most common support question was never about models — it was "why won't the app connect to my PC?" The answer is almost always TLS: iOS App Transport Security (rightly) refuses a plain http://192.168.x.x:11434, and asking normal people to mint certificates for their gaming PC is where the conversation dies.

MyLLM Connect is the small desktop companion that fixes that properly:

- It runs a tiny bearer-auth proxy in front of Ollama, bound to loopback only — the LAN can't even see it. Without the key every request gets a 401; chat streaming (NDJSON) passes through untouched. - It then runs `tailscale serve`, so the proxy gets a real https://your-machine.your-tailnet.ts.net address with a valid Let's Encrypt cert — over your own WireGuard mesh, reachable from anywhere, no port forwarding, nothing exposed to the public internet. - It renders a QR encoding url + a freshly minted access key. Scan it in the app and you're chatting with your own hardware. Rotating the key invalidates every paired device.

Stack: Tauri 2 / Rust, ~6 MB. The macOS build is signed + notarized (universal); Apache-2.0, so you can audit the path your prompts take. https://www.opticell-limited.com/myllm-1

Being upfront about the model: the companion is free and open; the iOS app is a one-off £3.99 (no subscription, no account, no telemetry — that's the whole point of the product, and the 401 lock is what keeps the free companion from being a free server for any client). If you don't want the app, the repo's PAIRING_PROTOCOL.md documents the whole contract and the proxy is a useful standalone pattern for putting any local service behind Tailscale with a bearer lock.

Honest gaps: Windows installer isn't code-signed yet (SmartScreen will warn); the model picker assumes Ollama is already installed (it guides, doesn't bundle); federation/multi-user is explicitly out of scope — this is one phone, one computer, your data.

Happy to answer anything about the iOS ATS dance, the loopback-behind-serve topology, or why we chose Tailscale over a public funnel.