Hey everyone. This is probably a super noob question, but I’m very much just an amateur when it comes to self-hosting.
I host several services that I access locally through 192.whatever:####, and when I occasionally need remote access, I use Tailscale and access through 100.whatever: ####. The duplicate bookmarks is mildly annoying though.
Can I just buy a personal domain, and have all my services be coolname.com:#### for both local and Tailscale access? Is that as simple a process as I want it to be?
Edit: I appreciate all the comments and I’ll probably just use Tailacale’s MagicDNS for simplicity, but one or my (unwritten, my bad) goals was to have one URL that works locally and remotely, regardless of Tailscale. I don’t leave Tailscale constantly connected because it overheats my phone (which already has terrible battery life).
For my lab I use a reverse proxy and a local DNS server. I recommend Nginx Proxy Manager (NPM) and adguard home for a easy gui.
you can buy a domain (for https that just works) or use the .internal tld reserved for internal use (not over Internet). ex: example.internal.
With a local internal domain: which then you either a) use http b) trust the "self-signed certificates c) create a local root certificate, install a certificate authority that once and use that to sign every websites certificate.
a and b are the simplest. To access websites you set the DNS server as your DNS for each device or point your router and tailscale configs to it.
each service then has a http(s)://service.example.internal that you type in that goes: device > router/tailscale (optional) > adguard > Nginx > service.
for a non internal domain you’d pay yearly or use something like duckdns.org for free. let’s encrypt and self signed is built into NPM.
I use pihole (DNS), caddy (reverse proxy), and tailscale (VPN) to host services under names like https://degoog.internal/
happy to give a more detailed description if you’d like
Look at their MagicDNS for this. It uses the hostname of the system along with your tailnet to allow you to do just this
So this definitely seems like the easiest solution, and MagicDNS is on by default, and the normal 100… address works fine, but no combination of the short or full domain seem to actually work. Not homeserver:#### nor homeserver.tail#.ts.net:#### nor even 100.100.100.100:####. Maybe it’s an issue with Unbound or something. Blargh.
This is the correct answer. You can even use it to force all the devices in your tailnet to use the same DNS server, and it’s really quite easy to host a sinkhole with either PiHole, AdGuard Home, or my preference, dnscryptproxy. Also works with just the hostname if you want. I.E.
ssh MyLinuxBoxworks just as well asssh MyLinuxBox.whatever.ts.net.If you want the service publicly accessible through the wider internet (the person doesn’t even need TS to access the website), check out TS Funnel.
Ooooh. I guess I have some reading to do.
<hostname>.ts.netshould automagically work whenever tailscale is on. You might have to enable something.If you want more specific, like sub domain names per service, you can set custom DNS records in tailscale to point to a caddy server which routes to the correct port. The caddy server doesn’t have to be the same machine as the service if its on the tailnet.
Getting https involved is a bit more tricky. You don’t need it because its all over wireguard already, but the browser doesn’t know that and will complain. I think official tailscale can distribute ssl certificates across your tailnet but if you’re using headscale you’ll either need to do that manually or buy a domain and have caddy auth for that domain.
You may not even need to buy a domain. You could use one like me.internal with something like split DNS - where if you come from your internal network you get one response (internal 192.x.y.z), and when you come from tailnet you get the tailnet addresses. You would need to set your DNS server to this one on your home network and the tailnet, ensure it’s set up to forward everything it doesn’t know you your ISP resolvers or like 1.1.1.1 as you normally have set up. If it’s all private and you don’t want public access then a public domain doesn’t benefit you.
I’m not sure with Tailscale, but in Netbird that’s pretty easy if you already have DNS setup on your local network.
You could do that, but you’ll need to employ some kind of DNS tuning so that:
- If you query for the domain from the LAN range, it responds with 192.whatever, and
- If you query for the domain from the Tailscale range, it responds with 100.64.whatever
The terminology for this is “split DNS” or “split horizon”. You can do this by selfhosting two DNS servers - one for the LAN and one for the Tailnet - with different records for the domain. You can selfhost the same DNS server on both the LAN and the Tailnet, and configure some rules so it answers differently based on the querant’s IP. Found this guide for Pi-hole. Technitium also works for this with its Split DNS app, but it’s a steeper learning curve.
Furthermore, if you don’t wanna pay for a domain, just use one of the free dynamic DNS services. https://afraid.org/ is one of them.
Alternatively, why not always connect to the Tailscale address in the first place? Tailscale probably run as an always-on VPN on your client device anyways, and you can reuse the address in the same LAN.
That’s a complicated question to answer, because when its said self-hosted practically means that you have the code stored in your servers. So you can buy the domain but depends what services you are running you’ll probably need a server for those services.
I might be about to proclaim my own ignorance, but I’m not entirely sure what you mean. I’m self-hosting on my own hardware in my living room. I’m just not good at it lol. I’d just rather pay a few dollars a year to not have you remember my Tailscale IP addresses.
I am not fully sure if it is clear. If not please send me a DM and I can explain better.
