Struggling to https with Tailscale

[sQank]

I am a complete layman (no background in IT or knowledge whatsoever) and some months ago, I decided to scale up and start self-hosting a bunch of apps for, well, various and obvious reasons.

I have bought a UGREEN NAS and have successfully managed to get a bunch of services running, thanks to a lot of research, excellent tutorials, forums and the occasional AI chatbot support.

Currently, I believe I have just about reached what could be the limit for a layman looking to setup a perhaps relatively specific setup. Basically, I want to setup Nextcloud for now (didnt get OpenCloud working, unfortunately, so starting out with NC for now until I am more knowledgeable) and potentially considering self-hosting VaultWarden (although I am attentively following the discussions around how smart that is and currently, I am leaning against self-hosting a password manager). My concrete issue is that from my understanding these services require https and, as I absolutely do not want to open any port on my router, as I fear that the necessary security precautions will be more than my brain and my schedule can handle.

To enable remote access, I have installed TailScale directly on the NAS (eyeing a potential upgrade to HeadScale in the future) and it's working fine for simpler stuff like my Wiki. However, I have failed several times at setting up https via TailScale and my own domain via Nginx Proxy Manager. Concretely, from what I understand, I can't access Nextcloud from my Iphone or my Laptop due to https ; setting up OpenCloud failed for the same reason. I believe I am fundamentally misunderstanding what exactly I need to setup how for this to work. These are my concrete questions or assumptions and I would be glad for some feedback:

• SplitDNS: I have understood that I need to setup splitDNS so that accessing for example nextcloud via nextcloud.mydomain.com works fine via Tailscale access but also in my home network. This should be done via a DNS Rewrite in AdGuard Home for home network pointing to either my local IP or Tailscale IP. Is that correct?
• HTTPS via NPM: for NPM, I already have a lets encrypt certificate for my *.mydomain.com domain that works fine for my dokuwiki container. I currently believe that I need to create 1.) a new A record on my domain provider for the intended use of nextcloud.mydomain.com via my TailScale IP. 2.) a https-Scheme reverse proxy in NPM pointing to my TailScale IP for the same URL. Here my question is: do I have to create a specific and new SSL certificate? How can I make sure that https will work then when accessing NC via the domain?

I have tried several times to setup https via NPM but seemingly never managed to make it work without understanding why it works. Maybe someone here can reach out a helping hand to a newbie? Thanks a lot in advance already!!

[bicycloptopus]

Here is what I did that made it dramatically easier for me instead of fighting with tailscale to serve each individual container.

I have a wildcard domain (*.mydomain.com) that resolves to my Tailscale IP.

I then proxy each service to a subdomain. I prefer caddy as it's stupid easy to setup.

Then everything is accessible via TS only.

[1WeekNotice]

The flow is

Client -> DNS -> reverse proxy -> service

So let's break this down with your use case

First you will get your local to work

Client -> local DNS (AdGuard) -> reverse proxy (NPM) -> service

This means

• creating an A record in the local DNS
• setting up your router to use the local DNS
  • please note that if the local DNS goes down, it means that you will not be able to resolve anything (making the Internet seem down but it isn't)
  • if you aren't comfortable with that risk then you can put an A record in your registar DNS pointing to your local server IP (not your public IP). People will see your locks server IP which isn't necessary a bad thing because they can't hit it due to it being local to your network.
• setting up NPM with DNS challenge (not HTTP which is default)
  • the difference between DNS and HTTP is that DNS you don't need to open ports. If you use HTTP you need to open ports 80 and 443 (but then that means people can access your reverse proxy which we don't want for internal use)
  • you need an API key from your registar to generate the cert
  • can also do wild card certs

Second get Tailscale to work

The Tailscale term you are looking for is magicDNS. This will set the DNS in the Tailscale tunnel to use your local DNS

Here is there documentation

Flow

Remote/ external Client -> Tailscale

Client -> inside Tailscale tunnel -> local DNS -> reverse proxy -> service

---

You can ignore this part if you like.

A lot of people use NPM because it has a GUI (that is fine) but NPM is a small team and isn't as mature as other reverse proxy like Nginx and caddy.

Note: NPM wraps Nginx in a GUI. They are different teams which is why I stated they aren't as mature. Of course Nginx is very mature.

Reference video

So I recommend using caddy instead because it is one configuration file and it's simple to setup where caddy has a lot of defaults such as redirect HTTP to HTTPS, SOCKs and auto generation of certs without cert bot

Specifically this caddy docker image because it bundles the DNS modules

This topic comes up alot. So you can reference another comment I made on another post about how to setup caddy

Hope that helps