AKGuidebooks Home Server Admin

Part 3: Make it a real server

14. Reach it from anywhere (Tailscale)#

What you'll do: connect your devices into a private network so you can reach the server from work, a café or mobile data, without opening anything on your router. Time: 30 minutes. Free for personal use.

How it works#

flowchart LR
  subgraph Away["At work / café / mobile"]
    M["Your laptop"]
  end
  subgraph Home["At home"]
    R["Home router<br/>(no changes!)"]
    S["Server"]
  end
  M == "encrypted private tunnel" ==> S
  R --- S

homeserver.local only works at home. Tailscale gives the server a name that works everywhere, for your own devices only.

Step 1: Create an account#

Go to https://tailscale.com and sign up with Google, Microsoft, Apple or GitHub.

Protect that account

Whoever controls this login controls your private network. Turn on two-factor authentication (an authenticator app or passkey) for the account you sign in with.

Step 2: Install on the server#

Type on: the server
curl -fsSL https://pkgs.tailscale.com/stable/debian/$(. /etc/os-release && echo $VERSION_CODENAME).noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
Type on: the server
curl -fsSL https://pkgs.tailscale.com/stable/debian/$(. /etc/os-release && echo $VERSION_CODENAME).tailscale-keyring.list | sudo tee /etc/apt/sources.list.d/tailscale.list
Type on: the server
sudo apt update
sudo apt install tailscale

These add Tailscale's official software source and install it. They work on any Debian version.

Step 3: Join the server to your network#

Type on: the server
sudo tailscale up

It prints a link like https://login.tailscale.com/a/abc123. Open it in your Mac or PC browser, sign in, and click Connect.

Keep that link private

Don't paste it into chats or documents.

Step 4: Stop the server from being logged out#

By default, Tailscale makes devices log in again every few months, which would cut off your server.

  1. Open https://login.tailscale.com/admin/machines.
  2. Click the ⋯ next to homeserver → Disable key expiry.

Step 5: Install on your devices#

Install the Tailscale app on your Mac, Windows PC and phone from https://tailscale.com/download (or the App Store), and sign in with the same account.

Step 6: Add a "remote" shortcut#

Keep your home shortcut (homeserver, which uses homeserver.local) and add a second one that goes through Tailscale. Then you always know which road you're taking.

First get the server's Tailscale address:

Type on: the server
tailscale ip -4

It prints a number starting with 100., for example 100.64.12.34. This number stays the same wherever the server is. Write it in your notebook.

Type on: your Mac
nano ~/.ssh/config

Add this below the existing Host homeserver block (use your own 100. number):

Add to: ~/.ssh/config on your Mac
Host homeserver-remote
    HostName 100.64.12.34
    User alex
    IdentityFile ~/.ssh/id_ed25519_homeserver
    IdentitiesOnly yes
    AddKeysToAgent yes
    UseKeychain yes
Type on: Windows (PowerShell)
notepad "$env:USERPROFILE\.ssh\config"

Add this below the existing block and save:

Add to: C:\Users\alex\.ssh\config
Host homeserver-remote
    HostName 100.64.12.34
    User alex
    IdentityFile ~/.ssh/id_ed25519_homeserver
    IdentitiesOnly yes

Duplicate the homeserver host, name the copy homeserver-remote, and set Hostname to your 100. number.

Shortcut Goes through Works
ssh homeserver homeserver.local on your home network At home only
ssh homeserver-remote Tailscale Anywhere, including at home, as long as Tailscale is on

Tailscale also gives a name

Tailscale makes the plain name homeserver work on your devices too (it calls this MagicDNS). Chapter 16 uses it for file sharing. If a name ever fails, the 100. number always works.

Step 7: Test away from home#

Turn off Wi-Fi on your phone and use mobile data, or connect your laptop to your phone's hotspot. Then:

Type on: your Mac or PC
ssh homeserver-remote

It should work exactly as at home.

Done when:

  • All devices appear on the Tailscale Machines page
  • Key expiry is disabled for the server
  • ssh homeserver-remote works from outside your home

Next: 15. Add hard drives

Made by Anish · 2026