Hey everyone. This is probably a super noob question, but I’m very much just an amateur when it comes to self-hosting.

I host several services that I access locally through 192.whatever:####, and when I occasionally need remote access, I use Tailscale and access through 100.whatever: ####. The duplicate bookmarks is mildly annoying though.

Can I just buy a personal domain, and have all my services be coolname.com:#### for both local and Tailscale access? Is that as simple a process as I want it to be?

Edit: I appreciate all the comments and I’ll probably just use Tailacale’s MagicDNS for simplicity, but one or my (unwritten, my bad) goals was to have one URL that works locally and remotely, regardless of Tailscale. I don’t leave Tailscale constantly connected because it overheats my phone (which already has terrible battery life).

  • djdarren@piefed.socialEnglish
    2·
    44 minutes ago

    My personal setup is that I have a VPS running Yunohost, with my own domain, so I added it to my Tailnet and set up redirects. So my navidrome server is pointed at https://navidrome.coolname.com/ via my home server’s Tailscale IP.

    Works well enough for me, but I don’t know anything about these things, so take my example with a pinch of salt.

  • lemmyvore@feddit.nlEnglish
    2·
    1 hour ago

    Can I just buy a personal domain, and have all my services be coolname.com:####

    It’s actually better. If you get a domain and install a reverse proxy on the server (Nginx Proxy Manager is easy to use) it will help you get free SSL certificates and make subdomain “aliases” so you’ll be able to use https://service.coolname.com/ links. And they’ll have the little shield in browsers and everything.

    To get the SSL certificates you’ll need an SSL service with an API and access tokens. Most domain registrars are not this fancy unfortunately, but you can delegate your nameservers to a (free) service that can do that. DeSEC.io is a good choice.

    You only need this DNS provider to verify the ownership of coolname.com. You do NOT need to put any IP in there.

    for both local and Tailscale access? Is that as simple a process as I want it to be?

    The Tailscale access is a bit more involved. Here’s the general steps:

    • Get Tailscale running on the server with all the services and the reverse proxy. Tailscale will create a network interface with a 100.64.x.x IP address.
    • Have the reverse proxy listen on all server interfaces including that 100.64 IP. Generally this should happen automatically. You should be able to see the reverse proxy admin page at http://100.64.x.x:8081 (or whatever the admin port is) as well as at http://[lan ip of the server]:8081.
    • In order to reach the reverse proxy over the LAN when you type service.coolname.com you will need to tell your LAN DNS server to resolve *.coolname.com to the LAN IP of your server.
    • Next you need to install a small DNS server but this one has to listen only on the Tailscale IP. Dnsmasq is a tiny server you can use for this. You want to configure it to resolve *.coolname.com to the Tailscale IP (100.64.x.x).
    • Then you go to the Tailscale admin page under the “DNS” section, click on “Add nameserver”, choose “Custom nameserver”, put in that Tailscale IP, check the “Restrict to domain” box and put “coolname.com” in there.

    After that, when you’re at home but NOT connected to Tailscale you will have coolname.com pointing at the reverse proxy via the LAN IP, and when you ARE connected to Tailscale (whether at home or not) it will be pointing to the Tailscale IP and go through the Tailscale VPN. So you’ll be able to use https://service.coolname.com/ all the time everywhere.

  • habitualTartare@lemmy.worldEnglish
    71·
    4 hours ago

    For my lab I use a reverse proxy and a local DNS server. I recommend Nginx Proxy Manager (NPM) and adguard home for a easy gui.

    you can buy a domain (for https that just works) or use the .internal tld reserved for internal use (not over Internet). ex: example.internal.

    With a local internal domain: which then you either a) use http b) trust the "self-signed certificates c) create a local root certificate, install a certificate authority that once and use that to sign every websites certificate.

    a and b are the simplest. To access websites you set the DNS server as your DNS for each device or point your router and tailscale configs to it.

    each service then has a http(s)://service.example.internal that you type in that goes: device > router/tailscale (optional) > adguard > Nginx > service.

    for a non internal domain you’d pay yearly or use something like duckdns.org for free. let’s encrypt and self signed is built into NPM.

  • Reannlegge@lemmy.caEnglish
    1·
    3 hours ago

    Can I just buy a personal domain, and have all my services be coolname.com:#### for both local and Tailscale access? Is that as simple a process as I want it to be?

    Yes you can, and it could be even simpler for you. You can get Caddy working and give each service its own address, (service).coolname.com no need for port number. Than you tell caddy what IP addresses it can host out to. But even if you did not want to buy a domain, you can still use caddy with some made up address.

    If you only have a few services running I am sure you could continue running the port numbers but I much prefer using caddy.

  • Encom@lemmy.worldEnglish
    19·
    7 hours ago

    Look at their MagicDNS for this. It uses the hostname of the system along with your tailnet to allow you to do just this

    • FedX@quokk.auEnglish
      5·
      5 hours ago

      This is the correct answer. You can even use it to force all the devices in your tailnet to use the same DNS server, and it’s really quite easy to host a sinkhole with either PiHole, AdGuard Home, or my preference, dnscryptproxy. Also works with just the hostname if you want. I.E. ssh MyLinuxBox works just as well as ssh MyLinuxBox.whatever.ts.net.

      If you want the service publicly accessible through the wider internet (the person doesn’t even need TS to access the website), check out TS Funnel.

      • lemmyvore@feddit.nlEnglish
        1·
        1 hour ago

        The downside to the .ts.net approach is that you need to install multiple TS clients if you want multiple subdomains. Typically one per service.

        There are projects like TSD-Proxy that help with that. It makes it so you only use one Docker container instead of having to make a sidecar container for every service.

        Then you also have to resolve *.tailnet.ts.net on your LAN’s DNS and that’s it. Unless you ever want to use something other than Tailscale, that is.

    • soratoyuki@piefed.zipOPEnglish
      1·
      4 hours ago

      So this definitely seems like the easiest solution, and MagicDNS is on by default, and the normal 100… address works fine, but no combination of the short or full domain seem to actually work. Not homeserver:#### nor homeserver.tail#.ts.net:#### nor even 100.100.100.100:####. Maybe it’s an issue with Unbound or something. Blargh.

      • FedX@quokk.auEnglish
        2·
        3 hours ago

        What are you testing MagicDNS with? What are the DNS settings? What does trying dog myhost (or dig, or using about:networking in a Firfox derived browser (maybe Chrome too?) if you prefer) tell you? For reference, on a Linux host (I don’t remember exactly, so don’t quote me), you should se something like this in /etc/resolv.conf

        nameserver 127.0.0.1
options edns0 trust-ad
search xxxxxx.ts.net xxxxxxxxxx.local.net
        • soratoyuki@piefed.zipOPEnglish
          1·
          1 hour ago

          So I was doing this from the (emulated?) terminal on my Android phone, and dig just returned command not found. I just got off work and moved to my desktop running Fedora, and on my desktop MagicDNS addresses work. Which I guess narrows things down.

          On my desktop, dig returns

           ; <<>> DiG 9.18.51-dev <<>> toshokun  
 # ;; global options: +cmd  
 ;; Got answer:  
 ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 6364  
 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1  
 
 ;; OPT PSEUDOSECTION:  
 ; EDNS: version: 0, flags:; udp: 65494  
 ;; QUESTION SECTION:  
 ;toshokun.                      IN      A  
 
 ;; Query time: 3960 msec  
 ;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)  
 ;; WHEN: Sat Nov 14 15:46:41 EST 2026  
 ;; MSG SIZE  rcvd: 37

          My resolv.conf is pretty similar. The namesever I’m pretty sure is correct for systemd reasons.

           nameserver 127.0.0.53  
 options edns0 trust-ad  
 search tail######.ts.net

          I appreciate the help, but realistically the answer to “Is that as simple a process as I want it to be?” is no, not quite, at least at my knowledge level lol. I’ll do more documentation reading in the meantime.

          • FedX@quokk.auEnglish
            1·
            10 minutes ago

            Interesting. Does trying to simply ping myhost or myhost.xxx.ts.net work?

  • CondorWonder@lemmy.caEnglish
    9·
    6 hours ago

    You may not even need to buy a domain. You could use one like me.internal with something like split DNS - where if you come from your internal network you get one response (internal 192.x.y.z), and when you come from tailnet you get the tailnet addresses. You would need to set your DNS server to this one on your home network and the tailnet, ensure it’s set up to forward everything it doesn’t know you your ISP resolvers or like 1.1.1.1 as you normally have set up. If it’s all private and you don’t want public access then a public domain doesn’t benefit you.

  • sudo@programming.devEnglish
    4·
    6 hours ago

    <hostname>.ts.net should automagically work whenever tailscale is on. You might have to enable something.

    If you want more specific, like sub domain names per service, you can set custom DNS records in tailscale to point to a caddy server which routes to the correct port. The caddy server doesn’t have to be the same machine as the service if its on the tailnet.

    Getting https involved is a bit more tricky. You don’t need it because its all over wireguard already, but the browser doesn’t know that and will complain. I think official tailscale can distribute ssl certificates across your tailnet but if you’re using headscale you’ll either need to do that manually or buy a domain and have caddy auth for that domain.

  • ShutUpWesley@piefed.zipEnglish
    4·
    6 hours ago

    I’m not sure with Tailscale, but in Netbird that’s pretty easy if you already have DNS setup on your local network.

  • AlmightyDoorman@kbin.earth
    1·
    5 hours ago

    I just use the zerotier vpn option to route all local ips through my home lan, so 192. domains are always reachable. Can’t tailscale do that?

  • stratself@lemdro.idEnglish
    3·
    6 hours ago

    You could do that, but you’ll need to employ some kind of DNS tuning so that:

    • If you query for the domain from the LAN range, it responds with 192.whatever, and
    • If you query for the domain from the Tailscale range, it responds with 100.64.whatever

    The terminology for this is “split DNS” or “split horizon”. You can do this by selfhosting two DNS servers - one for the LAN and one for the Tailnet - with different records for the domain. You can selfhost the same DNS server on both the LAN and the Tailnet, and configure some rules so it answers differently based on the querant’s IP. Found this guide for Pi-hole. Technitium also works for this with its Split DNS app, but it’s a steeper learning curve.

    Furthermore, if you don’t wanna pay for a domain, just use one of the free dynamic DNS services. https://afraid.org/ is one of them.

    Alternatively, why not always connect to the Tailscale address in the first place? Tailscale probably run as an always-on VPN on your client device anyways, and you can reuse the address in the same LAN.

  • Baldur@normals.me
    13·
    7 hours ago

    That’s a complicated question to answer, because when its said self-hosted practically means that you have the code stored in your servers. So you can buy the domain but depends what services you are running you’ll probably need a server for those services.

    • soratoyuki@piefed.zipOPEnglish
      1·
      6 hours ago

      I might be about to proclaim my own ignorance, but I’m not entirely sure what you mean. I’m self-hosting on my own hardware in my living room. I’m just not good at it lol. I’d just rather pay a few dollars a year to not have you remember my Tailscale IP addresses.

    • Baldur@normals.me
      11·
      6 hours ago

      I am not fully sure if it is clear. If not please send me a DM and I can explain better.