Levandor

OrcaSlicer (orcaslicer) — browser-streamed 3D slicer GUI on telep-mainframe

3 min read

Superseded / Retired — 2026-09-01

This standalone OrcaSlicer KasmVNC sidecar was DELETED in favor of bambuddy’s built-in Slicer API (server-side Bambu Studio slicing). The orcaslicer container, image, on-host config, AND the dedicated orcaslicer tailscale sidecar node were all removed, and the home-portal tile was taken out. Nothing below is live anymore — see 2026-09-01-bambuddy-slicer-api-pipelines-mcp for the replacement (slicer-api sidecar, material pipelines, maintenance, Telegram, and the tailnet MCP). Kept for history only.

Deployment of OrcaSlicer — a 3D-printing slicer (desktop GUI app) — self-hosted on telep-mainframe with its full desktop GUI streamed to the browser via the linuxserver.io KasmVNC image, behind a dedicated Tailscale sidecar node orcaslicer per the house per-service sidecar convention. Same pattern as chatcut and drive. All verified working 2026-09-01.

For Agents — quick facts

  • Web GUI: https://orcaslicer.taild4189d.ts.net (tailnet-only, no Funnel, LetsEncrypt via tailscale serve) — the full OrcaSlicer desktop over KasmVNC
  • First load ~13s (KasmVNC session spin-up), fast thereafter
  • Sidecar node orcaslicer = 100.126.7.69, tag:telep
  • Backend loopback: http://127.0.0.2:8570 (container port 3000, KasmVNC HTTP)
  • App config on host: /home/levander/orcaslicer/config
  • Same box as bambuddy + the Bambu printer (192.168.1.202) → slice→send works locally

Access

https://orcaslicer.taild4189d.ts.net — tailnet-only, no Funnel, real LetsEncrypt cert served by tailscale serve on the sidecar node. The web GUI is the entire OrcaSlicer desktop rendered over KasmVNC (not a web port of the app). First page load takes ~13s while the KasmVNC session spins up, then it’s responsive.

Tailscale sidecar node

Dedicated userspace tailscaled per the convention:

  • Service: tailscaled-orcaslicer.service (userspace-networking)
  • State dir: /var/lib/tailscale-orcaslicer
  • Socket: /run/tailscale-orcaslicer/tailscaled.sock
  • Node orcaslicer = 100.126.7.69, tag:telep
  • Provisioned via the Aperture Tailnet_provision_node one-time-key flow, then admin-approved + tagged in the console.

Manual device approval is ON for this tailnet

A freshly-provisioned node stays NeedsMachineAuth until approved in the admin console. Expect this — it is not an error.

tailscale serve config (on the sidecar node)

https://orcaslicer.taild4189d.ts.net/  (:443)  ->  http://127.0.0.2:8570

Backend is bound to 127.0.0.2 per the plaintext-port-hardening rule; tailscale serve adds the real TLS in front.

Container

docker run -d --name orcaslicer --restart unless-stopped \
  -e PUID=1000 -e PGID=1000 -e TZ=Europe/Budapest \
  -p 127.0.0.2:8570:3000 \
  --shm-size=1gb \
  -v /home/levander/orcaslicer/config:/config \
  lscr.io/linuxserver/orcaslicer:latest
  • KasmVNC serves HTTP on container port 3000, published to 127.0.0.2:8570.
  • Container also exposes 3001 (self-signed HTTPS) — not used; TLS is terminated by tailscale serve instead.
  • --shm-size=1gb is required for the browser/VNC session.

GPU is NOT passed through

The 3D viewport runs on software GL, which is fine for slicing and keeps the RTX 3080 free for other workloads (Frigate, OCR, etc.).

Home portal

Tile added to services.yaml under the 🛠️ Eszközök & Média group:

  • href → the ts.net URL
  • siteMonitor → http://127.0.0.2:8570

Prior config backed up as services.yaml.bak-orca.

Gotcha — NeedsLogin vs NeedsMachineAuth after tailscale up --authkey

A naive tailscale up --authkey=<key> with a truncated/mangled key silently yields BackendState=NeedsLogin (no obvious error) rather than NeedsMachineAuth. Fix was re-running with the full, intact key, which then went NeedsMachineAuth → approved in console.

Reusable diagnostic

  • NeedsLogin after an authkey up = bad / expired / incomplete key.
  • NeedsMachineAuth = key is fine, awaiting console approval.

Graph View

Backlinks