Open WebUI on the LAN without accidentally opening it to the world

Ollama + Open WebUI on a Spark. Family wants it on phones. I do not want 8080 on a VPS. Tailscale serve? Caddy + SSO? What are you people actually running?

Tailscale. Always Tailscale. Home Assistant in front if you also want voice. Do not port-forward a chatbot. Please.