GT horn button emblem← Back to The Archive
Archive / Self-Hosted Services

Tailscale Setup

Billville NAS reference for the Synology Tailscale container setup. Purpose: secure remote access to NAS services without public port forwarding.

Working
Connected to Tailscale
Remote Access Confirmed
Purpose

Private Remote Access

Tailscale provides encrypted private access to NAS services without opening more public ports. Only devices logged into the Tailscale account can access the services.

Access

Addressing

Tailscale IP
100.111.233.71
MagicDNS Preferred
http://tailscale-tailscale:PORT
Future Rename
Rename device later to synology for cleaner URLs.
Container Setup

Synology Docker

Image
tailscale/tailscale:latest
Network
host
Privileges
Execute container using high privilege.
Volume Mapping
/docker/tailscale → /var/lib/tailscale
Environment Variable
TS_STATE_DIR = /var/lib/tailscale
Important

Do Not Use

Do not use TS_USERSPACE for this setup.

Example Services

MagicDNS URLs

Music Assistant
http://tailscale-tailscale:8095
Vaultwarden
http://tailscale-tailscale:5151
Navidrome
http://tailscale-tailscale:4533
Key Concepts

How It Works

  • No port forwarding required.
  • All traffic is encrypted via Tailscale.
  • Only devices logged into the Tailscale account can access the NAS services.
Security Notes

Important Risks

  • Google account = gateway. It must have 2FA enabled.
  • Any device added to Tailscale can access NAS services.
  • Internal network is open unless ACLs are configured.
Maintenance

Reset Tailscale State

  1. Stop container.
  2. Delete contents of /docker/tailscale.
  3. Restart container.
  4. Re-authenticate using the login URL.
Future Improvements

Clean It Up Later

  • Rename node to synology.
  • Use MagicDNS everywhere.
  • Add ACL rules for tighter control.
  • Create clean service URLs.
Bottom Line

What Tailscale Replaces

Replaces

  • Port forwarding
  • Exposed NAS services

With

  • Private secure network access
  • Encrypted remote paths
  • Controlled device membership