Reaching Rocweb from anywhere with Tailscale Serve

Rocweb over plain HTTP on the local network is fine while you are stood next to the layout. The moment you want it from elsewhere, the obvious approaches are all bad: port forwarding exposes an application with no authentication to the entire internet, and dynamic DNS plus a self-signed certificate produces browser warnings you will train yourself to click through.

Tailscale Serve gives you a real HTTPS URL, reachable only by your own devices, with no ports open to anybody.

What it does

Tailscale builds a private network between your devices. Every machine gets a stable address and a DNS name that works from any of your other devices, wherever they are.

tailscale serve adds HTTPS on top: it terminates TLS using a genuine, automatically renewed certificate for your machine’s tailnet name, and proxies to a local port. No certificate warnings, no manual renewal, and nothing listening on your router.

Setting it up

On the machine running Rocrail, with Tailscale already installed and logged in:

tailscale serve --bg 8088

Replace 8088 with whatever port your Rocrail web service actually uses — check it in Rocrail’s own settings rather than assuming, as it varies between installations.

Check what you have configured:

tailscale serve status

That reports the public-facing HTTPS URL and the local port it forwards to. The URL will look like https://your-machine.your-tailnet.ts.net/, and it works from any device signed into the same tailnet.

The --bg flag matters: without it, the command runs in the foreground and the mapping disappears when you close the terminal. With it, the configuration persists across reboots.

Prerequisites

Two things need to be enabled in the Tailscale admin console, and both are one-off:

• MagicDNS, so the machine has a resolvable name
• HTTPS certificates, so Tailscale can issue the certificate

Without those, tailscale serve will tell you what is missing.

Serve, not Funnel

Tailscale offers a second command, tailscale funnel, which does the same job but publishes to the entire internet.

Do not use Funnel for this. Rocweb has no meaningful authentication, and it is wired directly to something that moves physical objects. Serve keeps it to your own devices, which is exactly where it belongs.

Using it on a phone or tablet

Install the Tailscale app, sign into the same account, and open the HTTPS URL. Because the certificate is genuine, it just loads — which also means you can add it to the home screen and have it behave like an app.

Removing it

tailscale serve --https=443 off

Why this beats a VPN back to the house

A traditional VPN routes everything through home and needs a port open on the router. Tailscale connects your devices directly to each other, needs no inbound port, and only carries traffic for the machines you are actually talking to.

For getting at one web interface on one machine, it is a much smaller thing to set up and a much smaller thing to get wrong.

Where to go next

• Rocrail and DCC-EX
• Running Rocrail as a systemd service — so it is there when you connect