Hello - please be gentle / kind with my question. I'm trying really hard to understand this and, as I'm doing research, I'm getting conflicting information (Or my brain's wires are getting crossed). My request is to help me understand how to implement this correctly.

 

What have I done so far and where I'm at:

• I have my tailscale set up - I have followed the documents provided by unRAID, and I have a subnet router set up, so that I access my LAN as if I was home. 
• I am currently planning the services that I want to have; for who is using them, It's me and my husband.
  • Jellyfin and the *arrs so that I can get a lot of great linux isos
  • Recipe Manager (like Tandoori Recipes or anything else that people recommend) - we have way too many recipes printed out.
  • Immich (google photos replacement) - both of us have a LOT of photos and videos
  • NextCloud (google docs/drive replacement) - mostly myself, but hubby is interested
  • Automated backups for our devices (windows, android, Mac, iPhone)
  • Open to other ideas as well!
• I bought the Flint 2 to replace my Fios G3100 because I wanted to install Tailscale &/or a VPN on my router (G3100 doesn't allow for this).

 

What I want to do / What my questions are:

1. Since I have tailscale - should I simply just integrate it into all my docker containers, and be done with it? I'm seeing a lot of user documentation in the dockers stating to not leave these services open and simply put them behind a reverse proxy? If so, how do I do that with Tailscale?
2. In the same vein, could I use Traefik or some other authentication service, and have them point to the websites that tailscale spits out? Meaning, I already have the (subdomain).(Tailscale Domain).ts.net, so couldn't I point it to that? Or do I need to buy a domain and do that whole process? For reference, I was looking at this resource.
3. On my Flint 2 - would I simply put it as an exit node, and be done with it? How does everyone else set up Tailscale with this particular router?
4. For the Jellyfin and the Arrs, do I put those behind a VPN (I plan to go with usenet), or what? Or should I just follow TRASH guides and Space Invader one?

Thanks for the guidance - I'm sorry for rambling - I'm at the end of a long day of teaching and this honestly brings me joy. I just want to do it correctly...

On 2/11/2025 at 4:07 AM, TheGreenWizard said:

I'm seeing a lot of user documentation in the dockers stating to not leave these services open and simply put them behind a reverse proxy?

This is not strictly necessary in a Tailscale network since this is a network which is only accessible for you and trusted members, similar to a LAN, so to speak, as long there are trusted members in there all should be fine without a Reverse Proxy.

 

On 2/11/2025 at 4:07 AM, TheGreenWizard said:

Or do I need to buy a domain and do that whole process?

Depends, but I would say no, since as said above, if there are only trusted members in your Tailnet the application logins should be fine.

 

On 2/11/2025 at 4:07 AM, TheGreenWizard said:

On my Flint 2 - would I simply put it as an exit node, and be done with it?

I assume you are talking about a router...? Don't know if you need that on your router, I would rather recommend that you install Tailscale on every end device which you are planing to use it and then you will be able to reach your services.

However it would be also possible to set this up on your router so that your entire network has access to but the configuration varies from device to device <- can't help with that since I don't know these devices.

 

On 2/11/2025 at 4:07 AM, TheGreenWizard said:

For the Jellyfin and the Arrs, do I put those behind a VPN (I plan to go with usenet), or what? Or should I just follow TRASH guides and Space Invader one?

You can set up a Exit Node in your Tailnet, probably a VPN container and let your containers which you want to route through a VPN tell to use this Exit Node, with that the containers will be using a VPN and at the same time will be reachable through your Tailnet.

 

 

 

On 2/11/2025 at 4:07 AM, TheGreenWizard said:

I just want to do it correctly...

Please take all the recommendations from my side with a grain of salt since you can do it multiple ways and there is not "one fits all" solution for that.

 

 

Options that you have on Unraid so far:

1. Tailscale Plugin
   Easy to use and set up, you can even expose all your containers through the ports in your Tailnet
   (Your whole server is in the Tailnet and is reachable by others in your network, this don't have to be a bad thing but I personally don't want to have my whole server in my Tailnet because of security reasons)
    
2. TSDProxy
   Easy to set up and to use, mainly meant for sharing your containers as dedicated machines in your Tailnet. Please keep in mind that you can't use Exit Node in containers with TSDProxy
   (TSDProxy is a Docker container which has access to your whole Docker System on your system, so to speak can also orchestrate your containers and has also access to your Tailnet, so to speak can also manage it)
    
3. Unraid Tailscale Docker Integration
   Relatively simply to use and to set up, mainly meant for getting your containers as dedicated machines in your Tailnet. Be Exit Node or use Exit Node is possible.
   (On startup it does hook into the container to make sure nothing is running before the application inside the container is running, install Tailscale and then start the application, because of security reasons like I mentioned above if a container is using a Exit Node, however it does not work with every Docker container out there)
    
4. Tailscale Sidecar Docker container
   This is the most complicated to use because you have to set up a second container, the Sidecar itself and then use the Sidecar's network in the container that you want to have in the Tailnet through container networking.
   (Everything should work as expected, except if you want to use an Exit Node since this feature seems to be broken as time of writing this. Please also keep in mind if you restart the Sidecar container you also have to restart the container which is using the Sidecar's network)

 

 

@EDACerton please correct me if I'm wrong above with my explanations, especially with the Tailscale Plugin and TSDProxy.

 

I hope that helps but maybe wait for the answer from @EDACerton.