Why use Tailscale with StreamStash?

StreamStash runs a local Flask server on a single Windows machine, with no cloud component. Tailscale gives you a secure private network across your devices so you can browse the StreamStash library from your phone or another laptop without exposing the machine to the public internet. There is no port forwarding, no public IP, no inbound firewall hole.

How do I set up Tailscale for StreamStash?

Install Tailscale on the StreamStash machine and sign in. Install Tailscale on your phone or other device and sign in to the same Tailscale account. Both devices now share a private network with stable internal IPs. Browse to the StreamStash machine's Tailscale IP plus its port from any other device on the network.

Can I access StreamStash from my phone?

Yes. Install the Tailscale mobile app on iOS or Android, sign in to your Tailscale account, and open the StreamStash machine's Tailscale IP in your phone browser. The library, player, and search work over Tailscale exactly as they do on the host machine.

What is MagicDNS and do I need it?

MagicDNS is a Tailscale feature that gives each device a human-readable name on your tailnet, so you can use 'http://my-streamstash-pc:port' instead of memorising an IP address. It is optional but convenient, especially for headless or NAS setups.

Is Tailscale secure for accessing my StreamStash library?

Tailscale uses WireGuard under the hood and only allows traffic between devices in your tailnet, both authenticated against your account. Nothing is publicly exposed. Combine it with a strong account password and 2FA, and your StreamStash instance stays private even though you can reach it from anywhere.

Remote Access

Remote Access with Tailscale

Access your StreamStash instance from anywhere — your phone, laptop, or another network — without opening ports or exposing your server to the internet.

What Is Tailscale?

Tailscale is a mesh VPN built on WireGuard that connects your devices into a private network. Every device gets a stable IP address (100.x.x.x) and can reach every other device on your Tailscale network — regardless of firewalls, NAT, or physical location.

This means you can run StreamStash on your home PC or NAS and access it from your phone while you're out, from your laptop at work, or from anywhere in the world — all without port forwarding, dynamic DNS, or exposing anything to the public internet.

Why Tailscale? StreamStash has no built-in authentication. Tailscale acts as your security layer — only devices on your private network can reach StreamStash. No one else can even see it exists.

How It Works

The setup is simple:

Install Tailscale on the machine running StreamStash (your server)
Install Tailscale on any device you want to access it from (your phone, laptop, etc.)
Both devices join the same Tailscale network
Access StreamStash via the Tailscale IP — done

Setup Guide

Step 1: Create a Tailscale account

Step 2: Install Tailscale on your StreamStash server

Windows (currently the only supported StreamStash platform):

Download the Tailscale app from tailscale.com/download and install it. Sign in with your account. Tailscale will run in your system tray.

After authenticating, your server will receive a Tailscale IP address (e.g. 100.64.0.1). Note this down.

Note: macOS and Linux builds of StreamStash are coming soon. Once available, you can install Tailscale on those platforms too — see tailscale.com/download.

Step 3: Install Tailscale on your other devices

Install the Tailscale app on any device you want to access StreamStash from:

iPhone / iPad — App Store
Android — Play Store
Windows / Mac / Linux — tailscale.com/download

Step 4: Access StreamStash remotely

With Tailscale connected on both devices, open a browser on your remote device and go to:

http://100.64.0.1:5000

Replace 100.64.0.1 with your server's actual Tailscale IP, and 5000 with your StreamStash port if you changed it.

That's it. No port forwarding, no firewall rules, no dynamic DNS. Tailscale handles all the networking.

Using MagicDNS (Optional)

Instead of remembering an IP address, you can enable MagicDNS in the Tailscale admin console to access your server by hostname:

http://my-server:5000

Go to the Tailscale admin console
Enable MagicDNS
Your server is now reachable by its machine name

Access from Your Phone

StreamStash's web interface works in mobile browsers. With Tailscale on your phone:

Open the Tailscale app and make sure it's connected
Open Safari or Chrome
Navigate to your StreamStash Tailscale IP or hostname
You'll see the full StreamStash dashboard — check downloads, monitor recordings, browse your library

NAS / Headless Server Setup

Coming Soon: NAS and headless Linux support for StreamStash is in active development. The Tailscale instructions below are correct for the platforms themselves — once StreamStash ships Linux/Docker builds, this setup will work out of the box.

When Linux/Docker support lands, Tailscale setup on these platforms is straightforward:

Synology

Install the Tailscale package from the Synology Package Center. Authenticate via the web interface.

Unraid

Install the Tailscale plugin from Community Applications. Configure via the plugin settings page.

Linux Server

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
# Note the 100.x.x.x IP printed

Security Considerations

StreamStash has no login system. Anyone on your Tailscale network can access it. Only invite trusted devices to your Tailscale account.
Tailscale uses WireGuard encryption. All traffic between your devices is end-to-end encrypted.
Nothing is exposed to the internet. Your StreamStash instance is invisible to port scanners, bots, and attackers. Only your Tailscale devices can see it.
Free tier is generous. Up to 100 devices, 3 users — more than enough for personal use.

Troubleshooting

Can't connect to StreamStash

Make sure Tailscale is running and connected on both devices
Verify the Tailscale IP: run tailscale ip on your server
Check that StreamStash is actually running: try accessing http://localhost:5000 on the server itself
If using a firewall on the server, allow port 5000 for the Tailscale interface (tailscale0)

Slow connection

Tailscale uses direct peer-to-peer connections when possible. If both devices are behind strict NATs, traffic may relay through Tailscale's DERP servers which adds latency. Check connection quality with tailscale ping <server-ip>.

Connection drops on mobile

Some mobile OS power-saving features may disconnect Tailscale in the background. On Android, disable battery optimization for the Tailscale app. On iOS, Tailscale reconnects automatically when you open the app.