Remote access: Tailscale

Tailscale puts your devices on a private network (a tailnet) with end-to-end encrypted WireGuard connections. Your Budvo server stays invisible to the internet; only your own signed-in devices can reach it. It's the most private way to use Budvo away from home.

1. Install Tailscale on the server machine

Install Tailscale on the machine that runs Docker (it's available for Linux, macOS, Windows and most NAS systems) and sign in. Then install it on your phone and laptop and sign in with the same account.

2. Open Budvo over the tailnet

Every device gets a name on your tailnet. From any of your devices, open:

http://<machine-name>:8484

That's it. There's nothing to change in Budvo, and BUDVO_TRUST_PROXY stays false.

3. Optional: HTTPS with tailscale serve

For a proper HTTPS address (needed later for passkeys, and nicer in the browser), turn on MagicDNS and HTTPS certificates in the Tailscale admin console, then on the server machine run:

tailscale serve --bg 8484

Budvo is now at https://<machine-name>.<your-tailnet>.ts.net, still reachable only from your tailnet. Because requests now come through Tailscale's proxy, set BUDVO_TRUST_PROXY: "true" in your compose file and run docker compose up -d again.

Sharing with your household

To give a partner access, invite them to your tailnet (or share just the server machine with them from the Tailscale admin console), then invite them to your household in Budvo.