Remotely access and share your self-hosted services

We're going to use Tailscale and the reverse proxy Caddy to share self-hosted services on your Tailnet with friends and family.
Personal accounts are always free on Tailscale and can include up to 3 users and 100 devices. Get started today at tailscale.com/yt
In today's video we focus on Immich - a self-hosted photo backup tool, Audiobookshelf - an audiobook server, and Jellyfin - an open source media server.
Choose your own adventure in today's video and use it as a resource to share with friends or relatives who you'd like to be access your services. If you're looking for the chapter to send your remote users to, it's at 10:44 "instructions for remote users".
- GitHub - Caddy and Custom Domains with Tailscale repo - github.com/tailscale-dev/vide...
- Cloudflare - Generating a Cloudflare API token documentation - developers.cloudflare.com/fun...
- Namecheap - How to register a domain name - www.namecheap.com/support/kno...
- Caddy - Reverse proxy quick start - caddyserver.com/docs/quick-st...
- Immich - Self-hosted backup solution for photos and videos on mobile devices - immich.app/
- Tailscale - Running Tailscale in LXC containers - tailscale.com/kb/1130/lxc-unp...
===
00:00 - Start
01:55 - What are we deploying then?
03:34 - Configuring Caddy (the reverse proxy)
06:33 - Configuring DNS
08:34 - A solution recap
09:55 - Generating an invite link
10:44 - Instructions for remote users
12:57 - Accepting the invite link
15:33 - Setting up a mobile device

[@Tailscale]

Note that in some circumstances, certain Operating Systems (Windows and Android) might not resolve these CNAMEs correctly. See this ongoing GitHub issue for more information if you run into issues. github.com/tailscale/tailscale/issues/7650

[@Batwam0]

Another reason to use Linux then 🎉

[@MrLurker101]

@@Batwam0 Android is based on what os?

[@Batwam0]

@@MrLurker101 please read “GNU/Linux distributions” then, or as I've recently taken to calling it, GNU plus Linux. Android isn’t based on another OS, it’s its own OS. it just happens to use the same kernel as GNU/Linux which isn’t relevant here as this a userspace issue as far as I can tell.

[@uidx-bob]

​@@Batwam0 I noticed this issue on my Debian 12 systems and FreeBSD 14 as well.

[@uidx-bob]

I noticed this on windows 11, debian 12, and FreeBSD 14.

[@seth2389]

There are good vides and there are great ones! And then, there is this! Great work Alex, keep raising that👙bar!

[@julianhamann4925]

Setting a CNAME record in Cloudflare to an FQDN on the tailnet felt like a switch in my brain just clicked and everything made sense.

[@Tailscale]

What would you have done if the whole video was 17 seconds long just saying that? :)

[@julianhamann4925]

@@TailscaleHonestly, little tid bits like that would make for some good technical content. Just like "10 things that make sense when using Tailscale". I just got started playing around with TS around Christmas and my current "solution" was that I registered my coredns server as a node on the tailnet and I serve a different view if the DNS query comes from within the tailnet. Then the hostnames get resolved to the actual tailnet IPs of the node, otherwise the local network address. I mean it works, but just using CNAMEs is so much easier lol

[@devendermahto]

​@@Tailscalehe is an idiot you have made a good video and I was using unraid with cloudflared tunnel now I know the importance of getting tailscale

[@tonyk2005]

​@@Tailscalesounds like a good idea for a KZbin short

[@4pmvim]

Ditto

[@robby_barnes]

I really appreciate the way you explain things. You do such a great job of explaining these things in a way that gives detail in a way that makes sense to people with a range of technical detail. I have a pretty strong technical background but it still bothers me when companies do the whole “step 1, draw some circles. Step 2, draw the rest of the owl” kind of tutorials. There aren’t enough people on the internet with positive feedback so I wanted to make sure to take a moment for it on this. Please keep these coming and keep up the good work, I for one really appreciate it.

[@Tailscale]

Thanks for teaching me how to draw an owl. O.O

[@gljames24]

This is perfect! I was just about to do this with immich, tailscale, and a reverse proxy, but I had no idea how to set it up. It's like this video was explicitly made for me!

[@ghangj]

Another BANGER from Alex. It is always a great time to learn more about Tailscale.

[@4pmvim]

Hey! Idk what’s more awesome at this point, your content or your product. Mad kudos! Thank you so much!!

[@menonrb]

This concept just suddenly became clear. Thank you for the instructions on how to do this. Was unhappy exposing certain services to the entire internet, but this video has clarified how this can be avoided. Nicely done.

[@amosgiture]

I always learn something new with Sir Alex. Thanks!

[@bikerchrisukk]

Video's like this were very much needed, nice one 👍 Really pleased to see Immich getting more attention - I haven't had a successful install using TrueNAS Scale, but I'm definitely keen to try it again very soon. Just about domains, but here in the UK I found OVH, super cheap. I've only used it for a casual use, but the ovh domain itself is very cheap. ...and after years of listening to Alex's podcasts, funny to actually see what he looks like!

[@IonyDFT]

Can't tell you how much I love tailscale!

[@malzbier1339]

Nice tutorial as usual 😎👍🏻

[@valterschmaltz]

I use to have cloudflare as my DNS server. Now I host my own technitium DNS server, and I configured tailscale to enforce that as the DNS server. In technitium I am using the split dns app, which allows me resolving to both tailscale and my lan IPs, depending where the client is connecting from. Works great.

[@freshnews8538]

Oh wow! Is it possible to share with a tutorial how you did it?

[@ultravioletiris6241]

Nice is the split DNS function natively built into technitium? Did you follow a guide or just figure it out?

[@annkretzschmar5085]

Great background!

[@alexclifford2485]

Brilliant. I've used tailscale for a family jellyfin server for our movies and shows, image syncing with photosync so it syncs my photos and videos from my phone to my hard drive from anywhere. Then I have a mini pc with a big 12TB hard drive connected with tailscale for personal cloud storage, accessible from any device. I use CX file explorer from my android phone and tablet to access my files on it. It has an upfront outlay but much much cheaper than any cloud storage (and larger). Plus I've got some other apps I'm experimenting with. Really brilliant piece of software. I've never come across something so practical and intuitive for networking devices.

[@DavidBrown-gl1bm]

Do you have redundancy on that local 12TB? I'd hate for you to lose data if a hard drive crashes.

[@Feerab]

Very interesting video I have tested it with My own domain and was working perfectly

[@uidx-bob]

Did you use a CNAme or A record? I could only get it to with an A record entry with the Tailscale node ip in it for a value. When I tried CNAME with Tailscale dns name I couldn’t get it to work.

[@Feerab]

CNAME was not working I use A record instead and works fine sorry that I didn't mention that before @@uidx-bob

[@Zylont]

@@uidx-bob Ah! thank you for this comment. Same thing, had to use an A record with the IP address to get it work. Using a CNAME with the Tailscale FQDN was not connecting for me.

[@rey6253]

Great video, this is what i do as well but i use nginx proxy manager as a reverse proxy. Overall works great exposing my docker containers but there is something I would like to do, is there any way to grant permission to a user only for one port? So i dont have tp grant them access to every system i have on my side. This would be better for security as well in case their device is somehow compromised

[@KD_Puvvadi]

The way I’ve setup this is, bind9 running on same device I’ve Tailscale and traefik. Using tailnet ip as custom dns on the shared tailnet. Works like charm

[@DavidErato]

What's the difference between using Caddy and a custom domain, vs just connecting to the service using the tailscale full domain and IP port? And how is that different from using a Funnel? Is there a way to share a service (like Plex) that is behind CGNAT without needing to share the caddy instance, if someone's device that may not have a native tailscale client (like Fire TV)?

[@walkerleigh]

Thanks Alex, I've been wanting to do this for a while. Shame about Android devices though. 🤩

[@CoryNadilo]

Thanks for the information. Is there anything else that needs to be in the CaddyFile to make Caddy function correctly? Thx

[@zshadows]

Can someone help me understand why we would use Caddy once we're on Tailscale? Is it necessary to resolve the requested subdomain to the correct port on the origin server?

[@Anonymous-dk5qu]

@Tailscale this is all really good stuff! Is there a way to build a Cloudflare tunnel with our tailscale domain ? I want to expose both TCP and UDP ports but funnel only allows TCP exposure

[@rafraf23534]

Great video! It would be great if you could do a tutorial for Tailscale ACLs

[@Tailscale]

Great suggestion!

[@sn0opyKS]

Really looking forward to finally be able to use my own domain as my Tailnet domain. Any ETA on that?

[@Tailscale]

There's a GitHub issue where you can track the status of this long running feature request. It's a surprisingly intricate thing to do right, so for now you'll have to "make do" with the "workaround" shown in the video. github.com/tailscale/tailscale/issues/4221

[@paul4143]

When sharing a node such as caddy to a friend using this method, do they access content directly (as in peer-to-peer) or does it go via Tailscale relays? I just wondered if there would be any bandwidth or speed limitations using this method?

[@Tailscale]

Tailscale does its best to establish direct connections whenever possible. “Tailscale ping node” will tell you what route traffic is taking.

[@Nate-D]

Thank you so much for this walk through! I have everything working with one exception. If I add a new entry to caddy, it will not get a cert from letsencrypt for that service unless I issue "tailscale down" and restart caddy. Restarting caddy with tailscale still connected results in not getting a cert. With tailscale down, It then grabs the cert and I can "talescale up" and everything works. Any advice on how to fix that?

[@Nate-D]

Update: I am not trying to reverse proxy to anything using magic DNS. None of my services are directly connected to tailscale. I was able to fix the issue by issuing "tailscale set --accept-dns=false". Caddy is now able to get certs with tailscale running. If someone can tell me what I may have boogered up in tailscale in terms of DNS to cause this failure, I am all ears!! LOL

[@Tailscale]

@@Nate-D hmmm - perhaps you might investigate a wildcard for your domain? sorry i didn't find this condition in my testing! -alex

[@hkfuertes]

I have a question and I don't know where to ask it....hahahaha, so the only thing I don't get from tailscale... Say I have 2 nodes, each of them behind NAT. How does my traffic flows when I choose one as exit node? All my traffic goes to tailscale servers and back and forth to the nodes? Or is there a way to bond the 2 connections together once the conversion is written in each table on the home routers, and therefore tail scale is just used for the "handshake"?

[@Tailscale]

A bit old, but still at the core of how Tailscale works - this blog post should clear this up for you. tailscale.com/blog/how-nat-traversal-works

[@hkfuertes]

Ok, so if I’m not wrong… Tailscale server is only used during the handshake ( exchange of WireGuard profile) right? From that point on, via NAT-T the communication is done directly NAT to NAT, right? For what I have read, there is an special udp/4500 always open that manages this NAT routing problem, right?

[@rodd5729]

The only part I can't figure, is the caddy server listening at the address of the tailnet right? Or is it listening at all the interfaces, like 0.0.0.0:80? Although, if caddy is listening at 0.0.0.0, then tailscale wouldn't even be required 😵

[@Tailscale]

Caddy in this example is running as an LXC container meaning it is a standalone node on the Tailnet. In this example, Caddy is listening on 0.0.0.0 in the LXC container. Tailscale is required for remote devices to be able to resolve the CNAME and route the traffic to Caddy.

[@hpbingham]

Can you comment on what I’d use in place of my Tailnet name if I was trying to configure this via Headscale? Would the IP of my Tailscale LXC do the trick?

[@sonny8085]

Is Caddy required if your remote friend/family member just joins your Tailnet directly? and doesn't setup their own?

[@Tailscale]

Technically it isn't _required_ for node sharing, but doing it this way means only sharing one node with relatives or friends. Caddy at this time is require for custom domain support as Tailscale itself only supports the `ts.net` names we generate for you.

[@JerryWoo96]

Would you create a tutorial for Traefik as well?

[@littlenewton6]

A very severe problem is the latency Tailscale turning from idle state to direct connecting. Based on the fundamental behavior of Tailscale, client will firstly try to create a connection over DERP. After a faster, direct connection is created, the Tailscale tunnel turns into direct. This process needs several seconds and I believe the latency would influence the quality of service or user experience. If there is an option which enable keeping alive, this problem could be mitigated.

[@cali0028]

Great video! I was trying to follow the instruction but currently stuck on finding the cloudflair tls dns key. Could you tell me where I would find that cloudflair dashboard ? thank you

[@cali0028]

Never mind I found the inst. on how to get the API key.

[@rhyme2192]

I use this same setup but will actually expose a few things directly to the internet instead. Me and wife have massive battery problems with tailscale on android which is just not worth it. Eats like 20 percent of battery per day. Will expose home assistant directly through caddy and mutual tls when coming from outside network.

[@ultravioletiris6241]

You also might consider a manual wireguard connection for the two phones rather than tailscale.

[@rhyme2192]

@@ultravioletiris6241 does the manual wireguard app for Android use kernel mode ? Is it less battery intensive?

[@thedanielfrg]

Really interesting. I have been doing this with cloudflare tunnels. Whats the advantage to do this with tailscale instead?

[@Tailscale]

Each device in your tailnet makes a best attempt at NAT traversal for establishing direct connections. So I would imagine that because there’s no middle man in that situation, performance would be better as you arent proxying all traffic via someone else.

[@thedanielfrg]

Very interesting. More reading to do! Loving the content!

[@ckwcfm]

I think one difference is with tunnel, you still open your service to the public, but with Tailscale, only people who joined your telnet can access the service.

[@absentfromtheworld]

Same here but this actually makes me thing of alternatives. This is why I've been loving Tailscale, makes me re-think my solutions

[@uidx-bob]

I believe one advantage this solution has over cloudflare tunnels is when you use cloudflare tunnels your terminating at the cloudflare managed proxy. At that point you are exposing your traffic.

[@cloud2050]

Great video, i was looking to replace my cloudflare vpn with tailscale, and this video opened my eyes. Just to confirm, the cname record you created in Cloudflare is only accessible over the tailscale network, correct? If so, can anyone using the tailscale network DNS resolve that cname?

[@Tailscale]

The CNAME itself is public but only routable via Tailscale (and more specifically, your Tailnet).

[@rustyb78]

Does this also work if you’re using cloudflare tunnels?

[@OfficialMikeJ]

There's a bandwidth limit on cloud flare tunnels you wouldn't be able to stream any media or watch videos etc

[@GadiantonsRobber]

Hi, noob here. So I own my domain at godaddy. Do I need to use cloudflare? Or is it possible to configure the DNS at godaddy?

[@DavidBrown-gl1bm]

To my understanding, any nameserver would do it, so you could use GoDaddy. They aren't using CF proxying for those CNAME records in this video, so CF is just providing some fast nameservers (I think direct access disables most other CF features).

[@Tailscale]

Any authoritative DNS server for your domain will do. Cloudflare as shown, is just an example. Godaddy should work but YMMV :angel:

[@pandadev_]

Where does that token come from and how do i get mine

[@Tailscale]

It's a Cloudflare API token. developers.cloudflare.com/fundamentals/api/get-started/create-token/

[@pandadev_]

@@Tailscale yeah i did know that but which permissions do i have to give it

[@shiftx999]

Nice. But where is the nix module for this? ;)

[@Tailscale]

PRs welcomed ;)

[@shawn2296]

cam i do the same with route53 as dns provider???

[@Tailscale]

More than likely yep!

[@rukhanzakaria]

KZbin short version please? 😊

[@aaron_chang]

Dang, saw this twice and still don't get it. Can't the host and the user just use tailscale and be done? What am I missing?

[@Tailscale]

If you want to use the provided tailnet domain it’s as easy as that. You only need to add the extra complexity if you want to use an external custom domain.

[@KristianTurner1]

Great video, but i think you are omitting quite the rabbithole of getting the cloudflare module into Caddy....

[@Tailscale]

It’s certainly an unusual system. But I wrote an ansible role years ago that handles it for me.

[@KristianTurner1]

@@Tailscale which permissions does your CF API have? Zone.Zone.Read and Zone.DNS.Edit?

[@PierreFiliatreault]

Thanks for the video. But I don't understand everything. 1- What is *rdu, do I have to use it? 2- where do I get the Cloudflare token. I can't find it on my account.

[@littlenewton6]

Firstly, you should have a good understand of DNS and its application. CNAME type is the core concept.

[@patrickskillin1798]

*rdu is just a wildcard and a name it could be anything *.self, *.nounderstanding, *.moreexplinationplease *.seriouslyyourgithubdocsarntcomplete. you get the idea and good question about the Cloudflare token, it feels important yet we have no info on it....

[@PierreFiliatreault]

@@littlenewton6 That's helpfull.

[@AlexKretzschmar]

@@patrickskillin1798at least you have a sense of humor! I’ll get the docs a bit more polished back in the office tomorrow for you, and I’ll add a little more info on the api token. 😅

[@PierreFiliatreault]

Thank you, it is truly appreciated.@@AlexKretzschmar

[@armanis1234]

not available for webos

[@localadm]

props you don't pronounce ubuntu as ubantu. thumbs up.

[@plagiats]

While this is very nice, I can't imagine any relative bothering... It's hard enough to get people to click on a Google photos link. Creating an account, installing tailscale, then clicking on the link, then installing the app but not clicking on the link anymore... I understand the logic, but real talk most people over 40 barely know how to send an email.

[@acedanger49]

40? doubtful. 60 maybe but 40 is way too young.

[@walkerleigh]

Whoa! That's a bit ageist! 😂 But you're right, they'd definitely have to be keen and a quite savvy at the other end.

[@ALERTua]

#unraidmasterrace

[@lifefromscratch2818]

Why the actual eff can you not make an account with Tailscale without using a big tech account? That's so stupid it's basically offensive.

[@DavidBrown-gl1bm]

What about Okta or OpenID Connect (OIDC) for your identity provider? Or consider self-hosting with Headscale? Tailscale argues "By design, Tailscale is not an identity provider-there are no Tailscale passwords. Using an identity provider is not only more secure than email and password, but it allows us to automatically rotate connection encryption keys, follow security policies set by your team (for example, MFA), and more."

[@abcproxy4155]

Hi, I would like to invite you to do a video issue for our products, how can I contact you?