Skip to main content
Version: 2026.8.0

Tailscale only

Tailscale is the recommended way to run Cobblr with real HTTPS and nothing exposed to the internet. There are two ways to ride it, so choose own hostname unless the box is already a tailnet node you want to serve from directly. The full walkthrough lives in Install. This page is the map of the two, so you can pick before you open that guide.

What Tailscale gives you

It puts your devices on a private mesh, hands each one an auto-renewed ts.net certificate, and the same URL works at home or away. That certificate is what the phone camera needs, and the private network doubles as secure remote access.

Own hostname (tsnet)​

The easier path, with the tidier URL. The bundled proxy joins your tailnet as its own node and serves the address you choose, so cobblr.your-tailnet.ts.net shows up as the node cobblr. The box needs no Tailscale install. Only the devices you browse from do.

In .env it looks like:

COBBLR_SITE_ADDRESS=cobblr.your-tailnet.ts.net
COMPOSE_PROFILES=caddy
COBBLR_TLS_MODE=tsnet
  • On first start the proxy prints a one-time sign-in link in its logs (docker compose logs caddy | grep -iE 'to authenticate|login.tailscale'). Open it, approve the new node, and you're done. There is no key to mint.
  • For an unattended join, add a reusable auth key as TS_AUTHKEY=tskey-auth-... and it skips the approval step.
  • The setup builder produces this when you pick Tailscale, then Own hostname. It needs MagicDNS and HTTPS certificates enabled on your tailnet, both one-time steps covered in Install.

The server's own name (tailscale serve)​

If the box is already on your tailnet, skip the bundled proxy and let the machine serve Cobblr under its own name. The stack runs without Caddy, the web container stays on loopback, and tailscale serve on the host publishes it with a real certificate:

COBBLR_SITE_ADDRESS=myserver.your-tailnet.ts.net
COMPOSE_PROFILES=

Then, after the stack is up, run sudo tailscale serve --bg 8088 on the box. This is the Server's name option in the builder. The steps, including reaching it from outside the tailnet with tailscale funnel, are in Install.

Which to pick​

Choose own hostname unless the box is already a tailnet node you want to serve from directly. It keeps Tailscale off the host and gives you a clean per-service URL. The serve variant fits when the machine is already on the tailnet and you would rather not run a second proxy.