-
Notifications
You must be signed in to change notification settings - Fork 1
tailscale
Tailscale builds a private network between your devices, so you can reach every service from anywhere with no port forwarding and nothing exposed publicly.
-
Create an account at tailscale.com (free for personal use).
-
Install Tailscale on your client devices.
-
Generate a reusable auth key at Admin Console > Settings > Keys — reusable so the container re-authenticates after restarts.
-
Add it to
.env:TS_AUTHKEY=tskey-auth-your-key-here TS_HOSTNAME=media-server
-
docker compose up -d, then approve the node in the admin console if prompted.
Auth keys expire — 90 days by default. Note the date, or the container drops off the tailnet on a restart long after you've forgotten it was configured.
| Service | Remote URL |
|---|---|
| Seerr | http://media-server:5055 |
| Sonarr | http://media-server:8989 |
| Radarr | http://media-server:7878 |
| SABnzbd | http://media-server:8080 |
| Bazarr | http://media-server:6767 |
| Prowlarr | http://media-server:9696 |
| Uptime Kuma | http://media-server:3001 |
Substitute your own TS_HOSTNAME. Short names work because
MagicDNS is on by default.
The container runs with --advertise-exit-node, so you can route all traffic from a remote device
through this host — enable it per-device in the admin console. It uses network_mode: host, which is
why it sees the other services directly.
To reach your whole LAN rather than just this host, add --advertise-routes in
docker-compose.override.yml (there's a commented example) and approve the route in the admin
console.
Enable HTTPS in Admin Console > DNS, then reach services at
https://media-server.your-tailnet.ts.net:<port>.