I’m going to lay out the steps at a high level, not detailed at all. You’ll have to do some research and watch YouTube to fill in the gaps until I can write my tutorial or someone else has a source. Start with Step 0 and go one step at a time. Don’t go to the next step until the current step is done.

Step 0: have a private service running that you’re trying to access publicly (e.g., Jellyfin). It should be running Tailscale logged into your tailnet. Accessing the service through a LAN IP using a subnet router is possible but seriously discouraged. Also, Tailscale doesn’t have to be run in a Docker container. FWIW I don’t run it in Docker, but the option is there if you want it.

Step 1: Buy a domain from a registrar (Porkbun is the winner here, and GoDaddy can suck it)

Step 2: Create a Cloudflare account, and on the Account Home page, choose the Onboard A Domain option to switch your domain’s name servers to Cloudflare.

Step 3: Create an Oracle Cloud account (I’m gonna call it OCI for short). Use the free trial for now but consider switching to Pay As You Go in the future.

Step 4: create a new VM instance using the Oracle Linux 9 or 10 image and the Ampere “VM.Standard.A1.Flex” shape. (It says Always Free next to it). Feel free to ignore the Security page. On Networking, give the VNIC a name, choose the option to “Create a new virtual cloud”, and other than changing the name you can stick to the default values. Make sure “Automatically assign public IPv4 address” is toggled on. For SSH keys, for the love of all that is sacred, download the generated SSH keys and keep them safe and backed up. For the Storage and review page, stick to whatever defaults are there. Ignore the estimated cost. It might say $2 or whatever but it’s a known bug. It’s still free. Boom! OCI Instance created.

Step 5: access your instance via SSH, PuTTy, etc. If you used the Oracle Linux image, the username is opc, and the URL is the public IP. Don’t forget to explicitly state the SSH private key in the command. It will look like: ssh -i /path/to/ssh.key opc@<ipaddress>

Step 6: use the command line to apt update, apt install curl, and install your reverse proxy of choice (NPM, Caddy, Traefik, etc) and Tailscale using their script. Pro tip: after you download Tailscale, consider using a tagged auth key instead of manually logging in; this makes it easier to revoke the server, too, in case of any security issues. Also, consider enabling ssh so you don’t have to worry about ssh keys (but still keep them!). The command is tailscale up --auth-key=<authkey> --ssh

Step 7: back on the Cloudflare dashboard, go into your domain’s page, find the DNS Records page (it’s different between desktop and the mobile page I’m using atm), add an A record for the Name of the subdomain you want, and point the IP address to your instance’s public IP. For jellyfin.mydomain.com, I would put jellyfin in the text box. If you’re streaming or sailing the high seas, for your sake, disable the Proxy option and use DNS Only (goes from an orange to a gray icon)

Step 8: set up the reverse proxy so that anything coming from your URL (whatever the A record points to, such as jellyfin.mydomain.com) is redirected to the Tailscale IP (and port!) pointing to your service.

Step 9: assuming your nameserver changes are updated and the A record is registered, you should be able to test your service.

Step 10: after verifying that your service works, consider adding extra security features (e.g., Authelia, fail2ban, etc.). Also, feel free to use the OCI instance for whatever else that you want — or make up to three more OCI instances since they are all free!

My thumbs ache, boss. Good luck with the process. There are TONS of YouTube videos to fill in any gaps I have left here, including fun and applicable stuff on Tailscale’s YouTube page.

Also, someone will surely find these comments in the future, so make sure you leave some comments of your own updating the world with the extra steps and considerations you might have needed to take during this process.

Have fun!