Hey everyone. This is probably a super noob question, but I’m very much just an amateur when it comes to self-hosting.
I host several services that I access locally through 192.whatever:####, and when I occasionally need remote access, I use Tailscale and access through 100.whatever: ####. The duplicate bookmarks is mildly annoying though.
Can I just buy a personal domain, and have all my services be coolname.com:#### for both local and Tailscale access? Is that as simple a process as I want it to be?
Edit: I appreciate all the comments and I’ll probably just use Tailacale’s MagicDNS for simplicity, but one or my (unwritten, my bad) goals was to have one URL that works locally and remotely, regardless of Tailscale. I don’t leave Tailscale constantly connected because it overheats my phone (which already has terrible battery life).
You don’t need DNS for this. If you want to use your 192.whatever away from home you can configure tailscale to route 192.whatever to your home network via an exit node.
Its called subnet routing and advertise routes btw. Just in case you wanna search the docs or find it in the cli/app.
This is the best answer, everyone else is making it complicates with DNS and reverse proxies… Exit node, or if you use straight wireguard and set the firewall zone rule on the wirguard PC/device to forwarding and allow masquerading that PC will send out the 192.1680.x.x request like its local.
Can I just buy a personal domain, and have all my services be coolname.com:####
It’s actually better. If you get a domain and install a reverse proxy on the server (Nginx Proxy Manager is easy to use) it will help you get free SSL certificates and make subdomain “aliases” so you’ll be able to use
https://service.coolname.com/links. And they’ll have the little shield in browsers and everything.To get the SSL certificates you’ll need an SSL service with an API and access tokens. Most domain registrars are not this fancy unfortunately, but you can delegate your nameservers to a (free) service that can do that. DeSEC.io is a good choice.
You only need this DNS provider to verify the ownership of coolname.com. You do NOT need to put any IP in there.
for both local and Tailscale access? Is that as simple a process as I want it to be?
The Tailscale access is a bit more involved. Here’s the general steps:
- Get Tailscale running on the server with all the services and the reverse proxy. Tailscale will create a network interface with a 100.64.x.x IP address.
- Have the reverse proxy listen on all server interfaces including that 100.64 IP. Generally this should happen automatically. You should be able to see the reverse proxy admin page at
http://100.64.x.x:8081(or whatever the admin port is) as well as athttp://[lan ip of the server]:8081. - In order to reach the reverse proxy over the LAN when you type service.coolname.com you will need to tell your LAN DNS server to resolve
*.coolname.comto the LAN IP of your server. - Next you need to install a small DNS server but this one has to listen only on the Tailscale IP. Dnsmasq is a tiny server you can use for this. You want to configure it to resolve
*.coolname.comto the Tailscale IP (100.64.x.x). - Then you go to the Tailscale admin page under the “DNS” section, click on “Add nameserver”, choose “Custom nameserver”, put in that Tailscale IP, check the “Restrict to domain” box and put “coolname.com” in there.
After that, when you’re at home but NOT connected to Tailscale you will have coolname.com pointing at the reverse proxy via the LAN IP, and when you ARE connected to Tailscale (whether at home or not) it will be pointing to the Tailscale IP and go through the Tailscale VPN. So you’ll be able to use
https://service.coolname.com/all the time everywhere.Look at their MagicDNS for this. It uses the hostname of the system along with your tailnet to allow you to do just this
Ooooh. I guess I have some reading to do.
This is the correct answer. You can even use it to force all the devices in your tailnet to use the same DNS server, and it’s really quite easy to host a sinkhole with either PiHole, AdGuard Home, or my preference, dnscryptproxy. Also works with just the hostname if you want. I.E.
ssh MyLinuxBoxworks just as well asssh MyLinuxBox.whatever.ts.net.If you want the service publicly accessible through the wider internet (the person doesn’t even need TS to access the website), check out TS Funnel.
The downside to the
.ts.netapproach is that you need to install multiple TS clients if you want multiple subdomains. Typically one per service.There are projects like TSD-Proxy that help with that. It makes it so you only use one Docker container instead of having to make a sidecar container for every service.
Then you also have to resolve
*.tailnet.ts.neton your LAN’s DNS and that’s it. Unless you ever want to use something other than Tailscale, that is.
So this definitely seems like the easiest solution, and MagicDNS is on by default, and the normal 100… address works fine, but no combination of the short or full domain seem to actually work. Not homeserver:#### nor homeserver.tail#.ts.net:#### nor even 100.100.100.100:####. Maybe it’s an issue with Unbound or something. Blargh.
What are you testing MagicDNS with? What are the DNS settings? What does trying
dog myhost(ordig, or usingabout:networkingin a Firfox derived browser (maybe Chrome too?) if you prefer) tell you? For reference, on a Linux host (I don’t remember exactly, so don’t quote me), you should se something like this in/etc/resolv.confnameserver 127.0.0.1 options edns0 trust-ad search xxxxxx.ts.net xxxxxxxxxx.local.netSo I was doing this from the (emulated?) terminal on my Android phone, and dig just returned command not found. I just got off work and moved to my desktop running Fedora, and on my desktop MagicDNS addresses work. Which I guess narrows things down.
On my desktop, dig returns
; <<>> DiG 9.18.51-dev <<>> toshokun # ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 6364 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 65494 ;; QUESTION SECTION: ;toshokun. IN A ;; Query time: 3960 msec ;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP) ;; WHEN: Sat Nov 14 15:46:41 EST 2026 ;; MSG SIZE rcvd: 37My resolv.conf is pretty similar. The namesever I’m pretty sure is correct for systemd reasons.
nameserver 127.0.0.53 options edns0 trust-ad search tail######.ts.netI appreciate the help, but realistically the answer to “Is that as simple a process as I want it to be?” is no, not quite, at least at my knowledge level lol. I’ll do more documentation reading in the meantime.
Interesting. Does trying to simply ping
myhostormyhost.xxx.ts.network?On Android (well, GrapheneOS) both return temporary failure in name resolution.
Pinging the Tailscale IP (the 100. one) returns 100% packet loss even though opening 100.whatever:#### works in a browser.
Ok, I think I am beginning to understand the issue. Can you try resolving the domain in your browser? If it’s a Firefox derivative, you can go to about:networking, and it gives you the ability to resolve a domain in the browser. Some Chrome based ones should have similar features, but YMMV.
For my lab I use a reverse proxy and a local DNS server. I recommend Nginx Proxy Manager (NPM) and adguard home for a easy gui.
you can buy a domain (for https that just works) or use the .internal tld reserved for internal use (not over Internet). ex: example.internal.
With a local internal domain: which then you either a) use http b) trust the "self-signed certificates c) create a local root certificate, install a certificate authority that once and use that to sign every websites certificate.
a and b are the simplest. To access websites you set the DNS server as your DNS for each device or point your router and tailscale configs to it.
each service then has a http(s)://service.example.internal that you type in that goes: device > router/tailscale (optional) > adguard > Nginx > service.
for a non internal domain you’d pay yearly or use something like duckdns.org for free. let’s encrypt and self signed is built into NPM.
You may not even need to buy a domain. You could use one like me.internal with something like split DNS - where if you come from your internal network you get one response (internal 192.x.y.z), and when you come from tailnet you get the tailnet addresses. You would need to set your DNS server to this one on your home network and the tailnet, ensure it’s set up to forward everything it doesn’t know you your ISP resolvers or like 1.1.1.1 as you normally have set up. If it’s all private and you don’t want public access then a public domain doesn’t benefit you.
I use pihole (DNS), caddy (reverse proxy), and tailscale (VPN) to host services under names like https://degoog.internal/
happy to give a more detailed description if you’d like
My personal setup is that I have a VPS running Yunohost, with my own domain, so I added it to my Tailnet and set up redirects. So my navidrome server is pointed at https://navidrome.coolname.com/ via my home server’s Tailscale IP.
Works well enough for me, but I don’t know anything about these things, so take my example with a pinch of salt.
I just bought a domain an hour ago. If you don’t care about the name you get a very cheap .xyz domain if it has only numbers. Look at https://news.gandi.net/en/2017/06/introducing-the-1-111b-class-of-xyz-domains/
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters AP WiFi Access Point DNS Domain Name Service/System ISP Internet Service Provider IoT Internet of Things for device controllers PiHole Network-wide ad-blocker (DNS sinkhole) SSH Secure Shell for remote terminal access UDP User Datagram Protocol, for real-time communications VPN Virtual Private Network VPS Virtual Private Server (opposed to shared hosting)
[Thread #169 for this comm, first seen 14th Nov 2026, 22:20] [FAQ] [Full list] [Contact] [Source code]
<hostname>.ts.netshould automagically work whenever tailscale is on. You might have to enable something.If you want more specific, like sub domain names per service, you can set custom DNS records in tailscale to point to a caddy server which routes to the correct port. The caddy server doesn’t have to be the same machine as the service if its on the tailnet.
Getting https involved is a bit more tricky. You don’t need it because its all over wireguard already, but the browser doesn’t know that and will complain. I think official tailscale can distribute ssl certificates across your tailnet but if you’re using headscale you’ll either need to do that manually or buy a domain and have caddy auth for that domain.
I’m not sure with Tailscale, but in Netbird that’s pretty easy if you already have DNS setup on your local network.
You could do that, but you’ll need to employ some kind of DNS tuning so that:
- If you query for the domain from the LAN range, it responds with 192.whatever, and
- If you query for the domain from the Tailscale range, it responds with 100.64.whatever
The terminology for this is “split DNS” or “split horizon”. You can do this by selfhosting two DNS servers - one for the LAN and one for the Tailnet - with different records for the domain. You can selfhost the same DNS server on both the LAN and the Tailnet, and configure some rules so it answers differently based on the querant’s IP. Found this guide for Pi-hole. Technitium also works for this with its Split DNS app, but it’s a steeper learning curve.
Furthermore, if you don’t wanna pay for a domain, just use one of the free dynamic DNS services. https://afraid.org/ is one of them.
Alternatively, why not always connect to the Tailscale address in the first place? Tailscale probably run as an always-on VPN on your client device anyways, and you can reuse the address in the same LAN.
Can I just buy a personal domain, and have all my services be coolname.com:#### for both local and Tailscale access? Is that as simple a process as I want it to be?
Yes you can, and it could be even simpler for you. You can get Caddy working and give each service its own address, (service).coolname.com no need for port number. Than you tell caddy what IP addresses it can host out to. But even if you did not want to buy a domain, you can still use caddy with some made up address.
If you only have a few services running I am sure you could continue running the port numbers but I much prefer using caddy.
Wouldn’t it be unsafe to expose to the internet like that?
Tl:dr:
- I use the non-typical LAN IP range, with odd numbers. With lots of vLANs and VPNs.
- I turn off port 22 if it does not need SSH access and if it does I change the port number and turn off password authentication and use keys instead.
- I have a kick-ass firewall with lots of rules and vLANs and a few VPNs.
- I have a honeypot for bots that gets logged with crowdsec.
- I have numerous wifi APs so devices stay in their lane.
- I annonomize my email for less tracking.
- I have a finally tuned pihole system set up, so much so that I cannot read an Arstecnica (I think it is) free article for another 100 years or something like that.
- When someone points something out that I am over looking I research about it and than find a way to fix the issue
- I do my best to not become the product by giving my information out just willy nilly.
- I look for self hosted options rather than ones that track me.
- I am moving away from Apple and into FOSS including Linux
- The only Google service I use now is youtube but that is with all the ads and tracking cut out.
Of the services I run I only have a few things exposed directly to the WAN, one comes from my LAN but redirects it to my VPS which hosts my blog (blog.reannlegge.ca). Fairly sure that is the only service that ordinary people can access from the VPS, and I personally do not remember if anything other than my domain name goes out from my homelab that is not connected to a VPN other than regular internet stuff which uses DoT.
I have a Flint2 with a vanilla install of openWRT and a poop load of vLANs, and a a few VPNs. Before I really got into the lifestyle of homelabing I made the booboo of trusting my ISPs firewall for stuff, fast forward several years when I decided to jump right into the deep end, instead of tip toeing deeper and deeper into homelabbing the first thing I should have done was get the Flint2 but instead I decided to get my first 2 static IP address (from my ISP). I was planning on hosting my own email but I found that this was not the best idea; if I wanted to keep my hair so I only use 1 of the 2 static IPs that my ISP provides at this time, the third static IP is my VPS.
The booboo I made tip toeing into homelabbing was opening my network up on port 22, so now the first thing I do when I connect anything to the internet is change its ssh port turn password authentication off and only use keys, the only things on my network that have port 22 open is my firewall so it can forward bots to my honey pot on its own separate vLAN (10.13.37.0) that I keep separated from everything else, but still you cannot ssh into the firewall without the key and the bot is logged with crowdsec, I am sure if someone join’s one of guest networks they could have port 22 open on there device but it is blocked on the firewall for that vLAN. Everything on my IoT vLAN (10.66.6.0) does not have access out to the WAN, but I can look at it all from anywhere via HomeAssistant on my home lab vLAN (10.0.69.0), feeling real mature setting that one up! Then my personal vLAN (10.42.0.0) and my personal VPN (10.42.69.0) can see everything in my home lab vLAN and the traffic to the LAN uses DoT. The guest vLAN (10.4.20.0 I think) and the kiddo vLAN (10.6.7.0) can only see out, and not see into my other vLANs, through whatever port DoT goes out through I wanna say 863? I think it is either that or just 443. Than I have 1 or 2 other VPNs, I plan to add another soon so I can leave a pi at my fathers place for an off site back up of some things on my LAN encrypted differently than my other off site back up. I have rules set up for web browsing to come in only on 443 rather than 80 if it is not coming in via DoT and it all goes through my pihole set up first. I choose the 10.0.0.0 range rather than the 196.0.0.0 or 172.0.0.0 range for security, it is far more unlikely that I will run across the 10.0.0.0 when on public wifi than the other two making it far easier for me to connect to my wireguard VPN. Security through obscurity and a fair bit of paranoia, and previous experience (do not leave port 22 open kids).
The Flint 2 can do a bunch of wifi and fire wall stuff that my old Apple Airport extreme could do, so now it sits in a closet plugged in with two APs that connect to nothing one quoting yoda “do or do not” and one quoting Obi-won “use the force” my active SSIDs are; NRC Appliance Devision, for my IoT stuff. Canadian Coast Guard Outpost, for my guest SSID (I live in Saskatchewan a landlocked province of Canada). Service Canada Youth Allowance, the kiddo guest wifi. CBSA Amnesty Bin 407, for my personal wifi. I have QR codes on my fridge for the two guest wifi APs. Just for fun my phones hot spot is CSA Orbital Debris Tracker, but it wireguards into my vLAN at home. I have a QR code somewhere in my phone for the other two guest VPNs, if I need them I guess OpenWRT also shares QR codes for the VPNs so I could log into it to share out guest VPN access.
Then you want to know about my email hygiene to prevent bad actors getting in that way? I use a different email address for everything, (service name)_(local slang)(three random numbers)@reannlegge.ca. If something gets spammy I can either bounce the email or silently delete it, or send it to my trash so that I can still see that it came through, if I need to extend the free trial just a little longer I can also just create a new account with a new email I have only done that once or twice. Sure I could continue to use my gmail email with the +function so reannlegge+service@gmail.com to stop spam but that is only stopping one devil while still letting one of the biggest in. While I was still using my ISPs email service I had paid for a year for one of those we will delete you from data broker scam systems but that was years ago before I started using individual email addresses for everything.
Than you want to know about my internet security? I use a pihole system with unbound directed to CIRA, I thought that was plenty secure enough until yesterday when someone informed me about how that still does not stop people from looking into my web traffic so I spent several minutes researching ODoH to find out it did not work with pihole than more researching DoH which again I found out does not work with pihole but than I spent several hours researching and implementing DOT because it does work with pihole. I could have dropped pihole and gone with ODoH, as it supposidly has some ad and tracker blocking but my pihole does so much more than just ad and tracker blocking. I have my pihole tuned up fairly close to a 10 out of 10.
If it is a web service I want to use first I look for a way to self host it, or something similar. Even though I have very high security only the parnoid survive. I have not ridden the bus for well over a decade approaching 2 until yesterday, rather than using the transits app I built my own for watching for buses. Sure the transit system can still track me using the tap card but what is that linked to? An email that is only used for the transit system, so they only know what buses I get on. Yesterday I was so annoyed that I was going to get on the bus and see all the ads along the top but there were none, bus fairs are not that expensive and there is no way that the taxes are going to pay so much to take care of it. Only one thing remains they are selling info to data brokers, which I do not care about because that is how the world works today, they are just not getting much from me.
I used to be a huge Apple fan girl but I have stopped that, if I had the money I would be replacing my ipad with something I could install Debian on. I am looking at replacing my phone with a pixel 10 and installing GrapheneOS on it soon, I was considering waiting for the Motorola phone next year but cost may be a bit much. When I was getting into smart home stuff, it was well before privacy became a goal in my mind so I was fine using AppleHome kit, when there was something I wanted to use that was not compatible with Apple’s walled garden I installed homebridge on one of my pi’s. I had raspberry pis because I was starting to get into security with pihole. The damn finally broke when Trump came into office and threatened to annex Canada I started moving services away from the big US tech and coming to Canada, I was no longer going to use Apple’s services so I went to Proton, but the CEO quickly got down on his knees for Trump so that was a nope for me. I came to Canada and orginally sold an arm and a leg to host my blog and email with HostHero but that relationship soured after a few years so I moved my domain over to easyDNS and there email service offers a wildcard option so I can create random emails on the spot rather than going to the page and setting up a new address. I found an old 2014 Mac mini and installed Debian on it to host my arr stack and Jellyfin on it, it does much better than pi 5 was doing. I had a pi 4 that I installed HAOS on got ride of AppleHome Kit entirely excluding 2 homepod minis, I am looking for something good to replace them with. I am hoping to get a hand me down Mac mini in a few days so I can install Debian and have a useable media centre PC currently I have a pi 5 and it doesn’t do to good with it.
I used to “just google it” but than Trump made his threats and I switched to ecosia, which I know is just Bing with a pretty mission statement but it was hosted out of the EU somewhere. As I got more comfortable with self hosting I switched to searXNG which I have setup to pull info ftom Bing, wikiepedia, and a few other engines I know it is still Bing without the pretty mission statement, but it also comes with no tracking!
So I play it safe on the internet!
Feeling safe on the internet is the first step of beeng fried from the Internet.
So you should add a part about Backups…
Well yes I have backups I wish I could say I follow the 3-2-1 rule but I am following more of a 2-2-1 rule for things that cannot be recovered if lost. My aim is to have a 2-2-2 setup next week hopefully.
@Reannlegge @selfhosted Truly, an epic post. Lots of good ideas here! You reminded me of a few things I’ve overlooked. I’m in the process of subnetting and VLANs and all the rest. It’s making my IoT devices crazy but eventually things will settle down. One thing you didn’t mention was printers. I am super paranoid about them. A few years ago somebody zombied mine and used it to attack my other devices from the inside! I eventually won that battle. Now I just leave the printer off and disconnected from the network unless I am going to print or scan something right then. You also didn’t mention Bluetooth. Last time I did a scan for devices it found over 200, all but a handful not mine. Anyway, thanks for posting. <<Hold the door!>>
Yes.
I also used this tool (https://github.com/canon2k5/tinyhome-py) to make a dashboard that points to all my services. You have to manually update it when something changes, but it’s made onboarding my partner much easier.
Also; I went for drive.customdomain.com, Jellyfin.customdomain.com, etc.
I just use the zerotier vpn option to route all local ips through my home lan, so 192. domains are always reachable. Can’t tailscale do that?
