# Remote access with Tailscale

Reach your *arr stack from outside the house using Tailscale, with no reverse proxy or open ports, and how to point Kochab at it.

Canonical: https://kochab.io/docs/remote-access-tailscale/

Tailscale puts your phone on the same private network as your stack over WireGuard, with no
reverse proxy, no forwarded port, and no certificate to manage. It pairs directly with Kochab's
home/away address switching.

This guide covers the Kochab side. For everything else - installing Tailscale, ACLs, exit
nodes - see the [Tailscale docs](https://tailscale.com/kb/).

## The two shapes

### Subnet router: same LAN address, everywhere

If your router or a box on your network already advertises your LAN as a Tailscale subnet route,
your phone reaches the same LAN addresses at home and away. Nothing changes in Kochab.

```shell
# On the router or box that can reach your whole LAN - IP forwarding first
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
sudo tailscale set --advertise-routes=192.168.1.0/24
```

Approve the route in the Tailscale admin console. Each client also needs
`tailscale set --accept-routes=true` before it will use advertised routes - this is on by
default for the mobile apps, but check it on a Linux or Windows client if the route does not
seem to be taking effect. To confirm the route is live from your phone, turn off Wi-Fi so it is
on cellular only, then load a LAN address in the browser - Tailscale has no CLI on mobile, so a
successful page load is the test. Once routing works, Kochab needs only the LAN address you
already use at home - no external address to add.

### Per-device: a Tailscale address per service

If you have not set up subnet routing, install Tailscale directly on the machine running your
stack instead:

```shell
tailscale up
```

Each device gets a stable `100.x.x.x` address and a MagicDNS name
(`tower.your-tailnet.ts.net`). Either works as an address; the MagicDNS name survives an IP
reassignment.

## Add the address in Kochab

Follow [Add and configure a service](/docs/add-a-service/) for the service itself, then decide
where the Tailscale address goes:

- **Subnet router:** nothing extra. Your existing LAN address in the **Host or IP** field already
  resolves over Tailscale.
- **Per-device:** expand **Advanced** and add the `100.x.x.x` address or MagicDNS name under
  **External address**, with the service's normal port. Leave **Use HTTPS** off unless the
  service terminates TLS itself - plain Tailscale traffic is already encrypted end to end, so
  there is nothing for Kochab to validate a certificate against.

Kochab orders the two by the network your phone is on - the LAN address first at home, the
external one first on a network it knows is not yours - and falls back to the other if the first
does not answer, so you do not have to switch anything by hand when you leave the house. See
[Reverse proxies and remote access](/docs/remote-access/#home-and-away) for how that switching
works.

## A plain-http external address needs one more step

Adding a plain-http external address prompts a one-time **Connect without encryption?** dialog,
since Kochab never sends credentials over http without you confirming it. That confirmation does
not carry over to being away from home: Kochab treats an unconfirmed plain-http external address
as unsafe to auto-select off your home network, so the same address that worked a minute ago at
home can go quiet the first time you actually leave.

The fix is a permanent designation, not a repeated confirmation. The first time you are away and
Kochab asks again, open **More > Stacks & Services > LAN Detection**. The address is listed
there with a **Mark as my tunnel** link - tap it once, and Kochab treats that address as always
safe to use, home or away, with no more prompts. This has to happen off-home: Kochab will not let
you set the designation in advance from your own network, since the point is confirming the
tunnel actually works before trusting it permanently.

This only applies to a Tailscale address in the **external** slot - the per-device shape above.
The subnet-router shape puts your Tailscale-routed LAN address in the primary field instead,
which this gate never touches.

## Optional: a real certificate with Tailscale Serve

If you want Kochab to see a publicly trusted certificate instead of skipping HTTPS validation,
`tailscale serve` can terminate TLS on your tailnet using a Tailscale-issued certificate for your
MagicDNS name. This needs MagicDNS and HTTPS certificates enabled first, in your tailnet's admin
console settings - `tailscale serve` will not provision one otherwise:

```shell
tailscale serve --bg --https=443 127.0.0.1:8989
```

`--bg` is required, or the proxy dies with the terminal session that started it. The TLS-terminated
endpoint listens on 443, not the service's own port, so enter the MagicDNS address in Kochab with
**Port** set to 443 and **Use HTTPS** on.

## Verify and troubleshoot

Run **Test & Add** when connecting the service. If it fails, work through
[Why won't Kochab connect to my service?](/docs/troubleshooting/service-wont-connect/) - the
common Tailscale-specific cause is a route that has not been approved yet in the admin console, or
a phone that has not reconnected to the tailnet since switching networks.