Remote access with Tailscale

Reach your *arr stack from outside the house using Tailscale, with no reverse proxy or open ports, and how to point Kochab at it.

Tailscale puts your phone on the same private network as your stack over WireGuard, with no reverse proxy, no forwarded port, and no certificate to manage. It pairs directly with Kochab’s home/away address switching.

This guide covers the Kochab side. For everything else - installing Tailscale, ACLs, exit nodes - see the Tailscale docs.

The two shapes

Subnet router: same LAN address, everywhere

If your router or a box on your network already advertises your LAN as a Tailscale subnet route, your phone reaches the same LAN addresses at home and away. Nothing changes in Kochab.

Terminal window
# On the router or box that can reach your whole LAN - IP forwarding first
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
sudo tailscale set --advertise-routes=192.168.1.0/24

Approve the route in the Tailscale admin console. Each client also needs tailscale set --accept-routes=true before it will use advertised routes - this is on by default for the mobile apps, but check it on a Linux or Windows client if the route does not seem to be taking effect. To confirm the route is live from your phone, turn off Wi-Fi so it is on cellular only, then load a LAN address in the browser - Tailscale has no CLI on mobile, so a successful page load is the test. Once routing works, Kochab needs only the LAN address you already use at home - no external address to add.

Per-device: a Tailscale address per service

If you have not set up subnet routing, install Tailscale directly on the machine running your stack instead:

Terminal window
tailscale up

Each device gets a stable 100.x.x.x address and a MagicDNS name (tower.your-tailnet.ts.net). Either works as an address; the MagicDNS name survives an IP reassignment.

Add the address in Kochab

Follow Add and configure a service for the service itself, then decide where the Tailscale address goes:

  • Subnet router: nothing extra. Your existing LAN address in the Host or IP field already resolves over Tailscale.
  • Per-device: expand Advanced and add the 100.x.x.x address or MagicDNS name under External address, with the service’s normal port. Leave Use HTTPS off unless the service terminates TLS itself - plain Tailscale traffic is already encrypted end to end, so there is nothing for Kochab to validate a certificate against.

Kochab orders the two by the network your phone is on - the LAN address first at home, the external one first on a network it knows is not yours - and falls back to the other if the first does not answer, so you do not have to switch anything by hand when you leave the house. See Reverse proxies and remote access for how that switching works.

A plain-http external address needs one more step

Adding a plain-http external address prompts a one-time Connect without encryption? dialog, since Kochab never sends credentials over http without you confirming it. That confirmation does not carry over to being away from home: Kochab treats an unconfirmed plain-http external address as unsafe to auto-select off your home network, so the same address that worked a minute ago at home can go quiet the first time you actually leave.

The fix is a permanent designation, not a repeated confirmation. The first time you are away and Kochab asks again, open More > Stacks & Services > LAN Detection. The address is listed there with a Mark as my tunnel link - tap it once, and Kochab treats that address as always safe to use, home or away, with no more prompts. This has to happen off-home: Kochab will not let you set the designation in advance from your own network, since the point is confirming the tunnel actually works before trusting it permanently.

This only applies to a Tailscale address in the external slot - the per-device shape above. The subnet-router shape puts your Tailscale-routed LAN address in the primary field instead, which this gate never touches.

Optional: a real certificate with Tailscale Serve

If you want Kochab to see a publicly trusted certificate instead of skipping HTTPS validation, tailscale serve can terminate TLS on your tailnet using a Tailscale-issued certificate for your MagicDNS name. This needs MagicDNS and HTTPS certificates enabled first, in your tailnet’s admin console settings - tailscale serve will not provision one otherwise:

Terminal window
tailscale serve --bg --https=443 127.0.0.1:8989

--bg is required, or the proxy dies with the terminal session that started it. The TLS-terminated endpoint listens on 443, not the service’s own port, so enter the MagicDNS address in Kochab with Port set to 443 and Use HTTPS on.

Verify and troubleshoot

Run Test & Add when connecting the service. If it fails, work through Why won’t Kochab connect to my service? - the common Tailscale-specific cause is a route that has not been approved yet in the admin console, or a phone that has not reconnected to the tailnet since switching networks.