Tailscale

Reach Nifty over HTTPS from your own devices only, with no ports opened.

On this page

Before you start
Set it up
The operator setting
Check it

With Tailscale, Nifty is at https://<machine>.<tailnet>.ts.net, and only devices on your tailnet can reach it. Tailscale provides the certificate.

Before you start

Tailscale must be installed and running on the server (sudo tailscale up).
MagicDNS and HTTPS Certificates must be on, in Tailscale's admin console under DNS.

Set it up

The easiest way is to use install.sh. Choose Over Tailscale, or pass --tailscale (Install on Linux).

To switch an existing server, follow these steps.

Let the nifty user manage tailscale serve.
```
sudo tailscale set --operator=nifty
```
In /etc/nifty.env, add this setting.
```
NIFTY_TAILSCALE_SERVE=on
```
Nifty must listen on loopback, as it does by default (127.0.0.1:4000). Nifty works out its own address. If you set NIFTY_ORIGIN, it must match.
Restart Nifty with sudo systemctl restart nifty.

Each time it starts, Nifty runs tailscale serve to pass https://<machine>.<tailnet>.ts.net to itself. To use another port, set NIFTY_TAILSCALE_PORT=8443. Nifty won't take a port that already serves something else.

The operator setting

Tailscale's operator can change any Tailscale setting on the computer. For example, it can log the computer out, or change exit nodes and other serves. If nifty is the operator, a compromised Nifty could do these things too. There's only one operator, so this setting replaces any other.

If you'd rather not make nifty the operator, run tailscale serve yourself once, as root. install.sh --tailscale --no-tailscale-operator does this for you.

sudo tailscale serve --bg --https=443 http://127.0.0.1:4000

Then, in /etc/nifty.env, leave NIFTY_TAILSCALE_SERVE off and add these settings.

NIFTY_ORIGIN=https://<machine>.<tailnet>.ts.net
NIFTY_TRUSTED_PROXIES=127.0.0.1

Tailscale keeps the serve across restarts. If it's ever removed, run the command again.

Check it

tailscale serve status

Serves stay after Nifty stops. To remove Nifty's serve, run sudo tailscale serve --https=443 off.