Nice! So you were able to get everything working?

Hey, can you elaborate a little bit more? Based on my Google search, casa-os is a front end for selfhosting? So, I would assume that you are not connecting to the right ports.

So, my assumption is: casa-os is using your port 80 and 443, so when you set up the DNS A Record, and navigate to it in your browser, it takes you to the homepage for casa-os. If this is indeed the case, then you have a couple options. You could:

1. Change the ports that casa-os is using and then rebind NGINX to 80 and 443
2. set up a second device just for NGINX (which is what I do, I use a Raspberry Pi just for network entry for stability reasons)
3. (I’ve never done this, so YMMV) you might be able to use Tailscale Serve
   • You would have it serve the port for NGINX under your Tailscale DNS name
   • Once you’re there, I imagine that you could use a CNAME DNS record or something on your custom domain in order to continue using the domains that you want, sub domains, SSL, etc.

Let me know what ends up working for you. I hope that either option 1 or 3 work, if those fail then you can definitely get it working via option 2 :)

Can you provide an example? I’m a little confused by what you mean.

Once the port is open, you should be able to access it via the tailscale IP just as you would locally on your network

Ahhh i gotcha, so basically it forwards traffic through the pi so that you can send traffic through tailscale on devices that don’t support it? Sounds like a cool idea tbh

Good on ya for the tailscale/syncthing though, off-site backups are super important! If Jellyfin supported federation you could merge your library and your parents library and have it all accessible through each of your local instances. Maybe one day they’ll add it, i think it would be a killer feature.

Glad the write-up helped though, it should at least help you move towards single instances (at least for immich) since you can just backup on tailscale via the dns entry!

Glad to help, yes that is a perfect example of how you could use this to your benefit. Much easier to just tell people to enable VPN (tailscale) and navigate to an easy to remember URL.

I’m somewhere in the middle, I do cybersecurity professionally so i work a lot with technical stuff but my hobbies are much deeper in it so theres a lot of stuff i don’t know. But, thanks to these communities i was able to learn how to do a lot of things and have now levelled up into doing the research on my own and trying to give back :)

In your dream scenario, is that each family member would be hosting immich/jellyfin on their pi zero? Or is the pi zero somehow routing traffic for them back to your server for jellyfin and immich?

Happy to help!

Side note, if you want to make publicly available services, you could use cloudflare tunnels. They work in a similar way – letting your services be accessible over the Internet without needing to open ports. Some other people in the comments have mentioned that Tailscale funnel can also work for this, but i haven’t used it so I can’t really advise on that front

Just looked it up, seems to pretty cool. Does it only work with one service though? You proxy one port to your tailscale domain name, but does it do routing for additional ports at the same time?

I’ve only done surface level research into it, and honestly didn’t come across this when i was doing the research for NGINX Proxy Manager, but it seems a little limited in comparison.

Happy to be proven wrong though, any easy solution is a good solution :)

That does work great, but when I’m on mobile i find it a lot easier to just go straight to the service rather than using a dashboard (although i have one set up)

Interesting, i didn’t know that but that is definitely something worth looking into if you need it for your usecase:

https://tailscale.com/kb/1223/funnel

Personally, I use a cloudflare tunnel for that. I’ll probably end up checking out tailscale funnel at some point for fun though

To my understanding, yes! I touched on it in the post but since tailscale is a VPN that doesn’t require open ports to access other devices in the tailnet, you don’t need to worry about CGNAT

Same thing,

CNAME: * -> @

Which translates to: * -> example.org

* Is a wildcard DNS character, basically meaning any subdomain will get forwarded to the root domain

Where? All the keys in the screenshots are sample keys

First SS: its 01234456789abcdef repeated Second SS: it just says yourapikeyhere

Yes, that is the intention. I suppose I probably could have just edited it to read ‘example.org’. But, it’s the shorthand notation @ refers to your domain name.

So the A record @ -> [Tailscale IP]

which DNS translates to example.org -> [Tailscale IP]

🫡 just doing my part, when i set it up it was a lot of digging through documentation and videos (the information is there, but it definitely requires some commitment in the research lol). Wanted to make something that gives it all in one go & helps the community out :)

Honestly, this is probably the enhancement to my homelab which has yielded the greatest QoL improvement. Prior to this, I would have to remember port numbers for every service and every ip address that i have something running on (and as my lab has expanded, this has become a lot more challenging).