Skip to content

Guides: no port forwarding to the apps, keep the tailnet private #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kalfasyan merged 1 commit into from
Nov 4, 2026
Merged

Guides: no port forwarding to the apps, keep the tailnet private #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions phones.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,16 @@ their `docs/deploy.md`.
Everyone who uses the apps needs to be on your tailnet. That suits a household; to share a
should-we decision with friends, use a public address instead.

**Keep your tailnet private.** Whoever gets into your Tailscale account can reach every app,
so:

- Turn on two-factor sign-in for the account you sign in to Tailscale with (Google, GitHub,
Microsoft or Apple).
- Remove phones and computers you no longer use from the
[machines page](https://login.tailscale.com/admin/machines), straight away for a lost one.
- Share the `selfhostit` machine with someone else's account (**Share** on the machines page)
instead of inviting them into your tailnet, so they reach the apps and nothing else of yours.

## Your own domain with a reverse proxy

For public addresses such as `https://splitwiz.example.com`:
Expand All @@ -76,6 +86,11 @@ For public addresses such as `https://splitwiz.example.com`:

- **Without opening your router:** a Cloudflare Tunnel does the same from the inside.

Forward only port 443, and only to the reverse proxy. Never forward an app's own port (8090
to 8093) in your router: that serves the app over plain `http://`, so passwords cross the
internet unencrypted, and it skips the proxy. Turn off **UPnP** in the router too, so no
device on your network can open a port by itself.

## Install the app on the phone

Open the app's `https://` address on the phone and sign in. Then:
Expand Down
5 changes: 5 additions & 0 deletions synology.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,11 @@ Two ways, both described in [phones](phones.md):
walks through it step by step; repeat the reverse proxy step for each app with its own
name, such as `flowy.<your-name>.synology.me` to port 8092.

Either way, don't forward the apps' ports (8090 to 8093) or DSM's own ports (5000, 5001) in
your router, and leave DSM's **QuickConnect** off unless you use it: they put the apps or
DSM's sign-in page on the internet, where bots try passwords all day. With a public address,
forward only 443 to DSM's reverse proxy.

## Updating and backups

With SSH on, `selfhostit update splitwiz` (or `flowy`, or `all`) pulls and restarts an app in
Expand Down
Loading