Custom domains and Tailscale

Submitted ⁨⁨8⁩ ⁨hours⁩ ago⁩ by ⁨soratoyuki@piefed.zip⁩ to ⁨selfhosted@lemmy.world⁩

Hey everyone. This is probably a super noob question, but I’m very much just an amateur when it comes to self-hosting.

I host several services that I access locally through 192.whatever:####, and when I occasionally need remote access, I use Tailscale and access through 100.whatever: ####. The duplicate bookmarks is mildly annoying though.

Can I just buy a personal domain, and have all my services be coolname.com:#### for both local and Tailscale access? Is that as simple a process as I want it to be?

source

Comments

Sort:hotnew top

lemmyvore@feddit.nl ⁨3⁩ ⁨hours⁩ ago
Can I just buy a personal domain, and have all my services be coolname.com:####

It’s actually better. If you get a domain and install a reverse proxy on the server (Nginx Proxy Manager is easy to use) it will help you get free SSL certificates and make subdomain “aliases” so you’ll be able to use https://service.cooldname.com/ links. And they’ll have the little shield in browsers and everything.

for both local and Tailscale access? Is that as simple a process as I want it to be?

The Tailscale access is a bit more involved. Here’s the general steps:

Get Tailscale running on the server with all the services and the reverse proxy. Tailscale will create a network interface with a 100.64.x.x IP address.

Have the reverse proxy listen on that 100.64 IP. Generally this should happen automatically since it tends to listen on all interfaces by default. You should be able to see the reverse proxy admin page at http://100.64.x.x:8081 (or whatever the admin port is).

In order to reach the reverse proxy when you type service.coolname.com you will need to tell your LAN DNS server to resolve *.coolname.com to the LAN IP of your server.

Next you need to install a small DNS server and also have it listen only on the Tailscale IP. Dnsmasq is a tiny server you can use for this. You want to configure it to resolve *.coolname.com to the Tailscale IP (100.64.x.x).

Then you go to the Tailscale admin page under the “DNS” section, click on “Add nameserver”, choose “Custom nameserver”, put in that Tailscale IP, check the “Restrict to domain” box and put “coolname.com” in there.

After that, when you’re at home but NOT connected to Tailscale you will have coolname.com pointing at the reverse proxy via the LAN IP, and when you ARE connected to Tailscale (whether at home or not) it will be pointing to the Tailscale IP and go through the Tailscale VPN. So you’ll be able to use https://service.coolname.com/ all the time everywhere.
source
Encom@lemmy.world ⁨8⁩ ⁨hours⁩ ago
Look at their MagicDNS for this. It uses the hostname of the system along with your tailnet to allow you to do just this

source
- soratoyuki@piefed.zip ⁨8⁩ ⁨hours⁩ ago
  Ooooh. I guess I have some reading to do.
  
  source
- FedX@quokk.au ⁨7⁩ ⁨hours⁩ ago
  This is the correct answer. You can even use it to force all the devices in your tailnet to use the same DNS server, and it’s really quite easy to host a sinkhole with either PiHole, AdGuard Home, or my preference, dnscryptproxy. Also works with just the hostname if you want. I.E. ssh MyLinuxBox works just as well as ssh MyLinuxBox.whatever.ts.net.
  
  If you want the service publicly accessible through the wider internet (the person doesn’t even need TS to access the website), check out TS Funnel.
  
  source
  - lemmyvore@feddit.nl ⁨3⁩ ⁨hours⁩ ago
    The downside to the .ts.net approach is that you need to install multiple TS clients if you want multiple subdomains. Typically one per service.
    
    There are projects like TSD-Proxy that help with that. It makes it so you only use one Docker container instead of having to make a sidecar container for every service.
    
    Then you also have to resolve *.tailnet.ts.net on your LAN’s DNS and that’s it. Unless you ever want to use something other than Tailscale, that is.
    
    source
- soratoyuki@piefed.zip ⁨5⁩ ⁨hours⁩ ago
  So this definitely seems like the easiest solution, and MagicDNS is on by default, and the normal 100… address works fine, but no combination of the short or full domain seem to actually work. Not homeserver:#### nor homeserver.tail#.ts.net:#### nor even 100.100.100.100:####. Maybe it’s an issue with Unbound or something. Blargh.
  
  source
  - FedX@quokk.au ⁨5⁩ ⁨hours⁩ ago
    What are you testing MagicDNS with? What are the DNS settings? What does trying dog myhost (or dig, or using about:networking in a Firfox derived browser (maybe Chrome too?) if you prefer) tell you? For reference, on a Linux host (I don’t remember exactly, so don’t quote me), you should se something like this in /etc/resolv.conf
    
    nameserver 127.0.0.1 options edns0 trust-ad search xxxxxx.ts.net xxxxxxxxxx.local.net
    
    source
    -> View More Comments

Decronym@lemmy.decronym.xyz [bot] ⁨1⁩ ⁨hour⁩ ago

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters	More Letters
DNS	Domain Name Service/System
ISP	Internet Service Provider
PiHole	Network-wide ad-blocker (DNS sinkhole)
UDP	User Datagram Protocol, for real-time communications
VPN	Virtual Private Network
VPS	Virtual Private Server (opposed to shared hosting)

[Thread #169 for this comm, first seen 14th Nov 2026, 22:20] [FAQ] [Full list] [Contact] [Source code]

source

djdarren@piefed.social ⁨2⁩ ⁨hours⁩ ago
My personal setup is that I have a VPS running Yunohost, with my own domain, so I added it to my Tailnet and set up redirects. So my navidrome server is pointed at https://navidrome.coolname.com via my home server’s Tailscale IP.

Works well enough for me, but I don’t know anything about these things, so take my example with a pinch of salt.

source
habitualTartare@lemmy.world ⁨5⁩ ⁨hours⁩ ago
For my lab I use a reverse proxy and a local DNS server. I recommend Nginx Proxy Manager (NPM) and adguard home for a easy gui.

you can buy a domain (for https that just works) or use the .internal tld reserved for internal use (not over Internet). ex: example.internal.

With a local internal domain: which then you either a) use http b) trust the "self-signed certificates c) create a local root certificate, install a certificate authority that once and use that to sign every websites certificate.

a and b are the simplest. To access websites you set the DNS server as your DNS for each device or point your router and tailscale configs to it.

each service then has a http(s)://service.example.internal that you type in that goes: device > router/tailscale (optional) > adguard > Nginx > service.

for a non internal domain you’d pay yearly or use something like duckdns.org for free. let’s encrypt and self signed is built into NPM.

source
thestrike@lemmy.blahaj.zone ⁨7⁩ ⁨hours⁩ ago
I use pihole (DNS), caddy (reverse proxy), and tailscale (VPN) to host services under names like degoog.internal

happy to give a more detailed description if you’d like

source
CondorWonder@lemmy.ca ⁨8⁩ ⁨hours⁩ ago
You may not even need to buy a domain. You could use one like me.internal with something like split DNS - where if you come from your internal network you get one response (internal 192.x.y.z), and when you come from tailnet you get the tailnet addresses. You would need to set your DNS server to this one on your home network and the tailnet, ensure it’s set up to forward everything it doesn’t know you your ISP resolvers or like 1.1.1.1 as you normally have set up. If it’s all private and you don’t want public access then a public domain doesn’t benefit you.

source
driftWood@infosec.pub ⁨3⁩ ⁨hours⁩ ago
I just bought a domain an hour ago. If you don’t care about the name you get a very cheap .xyz domain if it has only numbers. Look at news.gandi.net/…/introducing-the-1-111b-class-of-…

source
sudo@programming.dev ⁨7⁩ ⁨hours⁩ ago
<hostname>.ts.net should automagically work whenever tailscale is on. You might have to enable something.

If you want more specific, like sub domain names per service, you can set custom DNS records in tailscale to point to a caddy server which routes to the correct port. The caddy server doesn’t have to be the same machine as the service if its on the tailnet.

Getting https involved is a bit more tricky. You don’t need it because its all over wireguard already, but the browser doesn’t know that and will complain. I think official tailscale can distribute ssl certificates across your tailnet but if you’re using headscale you’ll either need to do that manually or buy a domain and have caddy auth for that domain.

source
ShutUpWesley@piefed.zip ⁨8⁩ ⁨hours⁩ ago
I’m not sure with Tailscale, but in Netbird that’s pretty easy if you already have DNS setup on your local network.

source
stratself@lemdro.id ⁨8⁩ ⁨hours⁩ ago
You could do that, but you’ll need to employ some kind of DNS tuning so that:

If you query for the domain from the LAN range, it responds with 192.whatever, and

If you query for the domain from the Tailscale range, it responds with 100.64.whatever

The terminology for this is “split DNS” or “split horizon”. You can do this by selfhosting two DNS servers - one for the LAN and one for the Tailnet - with different records for the domain. You can selfhost the same DNS server on both the LAN and the Tailnet, and configure some rules so it answers differently based on the querant’s IP. Found this guide for Pi-hole. Technitium also works for this with its Split DNS app, but it’s a steeper learning curve.

Furthermore, if you don’t wanna pay for a domain, just use one of the free dynamic DNS services. afraid.org is one of them.

Alternatively, why not always connect to the Tailscale address in the first place? Tailscale probably run as an always-on VPN on your client device anyways, and you can reuse the address in the same LAN.
source
Reannlegge@lemmy.ca ⁨4⁩ ⁨hours⁩ ago

Can I just buy a personal domain, and have all my services be coolname.com:#### for both local and Tailscale access? Is that as simple a process as I want it to be?

Yes you can, and it could be even simpler for you. You can get Caddy working and give each service its own address, (service).coolname.com no need for port number. Than you tell caddy what IP addresses it can host out to. But even if you did not want to buy a domain, you can still use caddy with some made up address.

If you only have a few services running I am sure you could continue running the port numbers but I much prefer using caddy.

source
AlmightyDoorman@kbin.earth ⁨6⁩ ⁨hours⁩ ago
I just use the zerotier vpn option to route all local ips through my home lan, so 192. domains are always reachable. Can't tailscale do that?

source