Remote access
Four ways to reach your apps from outside the house, and how to choose between them.
Everything works at home out of the box. Reaching it from outside is a choice, and the four options trade different things.
| Option | Good for | Opens a port? |
|---|---|---|
| Tailscale | The easiest private access for your own devices. Works behind any router. | No |
| Headscale | The same as Tailscale, with the coordination server on your own box instead of a company's. | Yes — HTTPS |
| VPN (WireGuard) | A classic VPN: scan a QR code on your phone and you are on the home network. | Yes — one UDP port |
| Cloudflare Tunnel | Publishing an app on your own domain for anyone to open in a browser. | No |
Private access: Tailscale
Install the Tailscale app on your phone and laptop, install the Tailscale module on the box, and paste an auth key into Settings. Every device lands on one private network, wherever it is. To reach the rest of your home network too, advertise the box as a subnet router.
Private access, fully yours: Headscale
Headscale replaces Tailscale's coordination server; your devices still use the normal Tailscale apps. Point them at your server:
tailscale up --login-server https://headscale.example.comHeadscale cannot go through a Cloudflare Tunnel or Cloudflare's proxy. Tailscale's protocol needs an HTTPS connection upgrade that Cloudflare does not pass through. Publish it directly instead: forward port 443 to the box, give it a certificate with the Proxy Manager, and keep its DNS record DNS only.
If your devices at home cannot reach it by its public name, your router probably does not support NAT reflection. Add a local DNS override that points the name at the box's local address.
Classic VPN: WireGuard
Install the VPN module, set its public address to your home IP or dynamic-DNS name, and forward UDP port 51820 on your router — only that. Add a device in the web UI and scan the QR code with the WireGuard app.
Publishing an app: Cloudflare Tunnel
Create a tunnel in the Cloudflare dashboard, paste its token into the Cloudflare Tunnel module, and map a hostname to an app. Nothing is opened on your router. Anything published this way is reachable by the whole internet, so put Cloudflare Access in front of any app whose own login you would not trust on its own.
A tunnel is also the simplest way to give Vaultwarden the HTTPS it needs.