YOUR FILES,
ANYWHERE

Two parts. Most people only need the first.

Part 1: connect everything (steps 1 to 5)

• One private network for your computers, phone, tablet and NAS, wherever each one is.
• Your files from anywhere: open the folder on your home computer or NAS from your laptop at a coffee shop, like it's sitting next to you.
• Any computer's screen from anywhere: check on a long export or grab a file you forgot.
• Nothing exposed to the internet. No port forwarding, no "remote access" accounts, no files sitting on someone else's cloud.

Part 2: an always-on computer (steps 6 to 12)

• A computer that never sleeps and runs the jobs your laptop shouldn't: automations like n8n, an offline library, a small local AI, home automation, a camera recorder.
• A spare laptop, an old Mac mini or a cheap mini PC is plenty.

What it costs

Nothing for Tailscale for personal use. Its free Personal plan covers up to 6 users with unlimited personal devices, for non-commercial use. Part 2 adds a little electricity, and a battery backup is the one purchase worth making early.

How long it takes

About 20 minutes for Part 1. An afternoon for a home server. Each service after that is an evening.

Tailscale gives each of your devices a private address on your own network (a "tailnet"). They find each other wherever they are, at home, on cell data, in a hotel. Traffic goes device to device, encrypted, and nothing is opened to the internet.

1. Make a Tailscale account. Pick the login you want to own this long-term (more on why in step 5).
2. Install the Tailscale app on each device and sign in with that same account: Mac, Windows, iPhone, Android, iPad. Each one shows up in the admin console.
3. On Linux:

   sudo apt install -y curl
   curl -fsSL https://tailscale.com/install.sh | sh
   sudo tailscale up

   Open the link it prints and approve the machine.
4. For any computer that stays on at home (a desktop, the NAS, a server), find it in the admin console and disable key expiry. New tailnets expire each device's login after 180 days by default. That's fine for a laptop you use every day and bad for a machine nobody is sitting at.

Turn on MagicDNS in the Tailscale admin console (DNS tab). Then you reach machines by name, like studio or nas, instead of memorizing addresses.

• Name each machine in two places. The name in the Tailscale console and the computer's own name are separate settings. Set them to match, or names will disagree in confusing ways later.
• Keep the Tailscale address as a fallback. If connecting by name fails but the 100.x.y.z address works, it's a naming problem, not a network problem. That one test saves an hour.
• Machines shared with other people only resolve by their full name (nas.your-tailnet.ts.net), not the short one.

Once every device is on the tailnet, the normal file sharing built into your computers works from anywhere, as if you were at home.

From a Mac

• On the Mac that has the files: System Settings → General → Sharing → turn on File Sharing and add the folders you want.
• From another Mac anywhere: Finder → Go → Connect to Server → smb://studio (use the machine's name).

From Windows

• Share the folder (right-click → Properties → Sharing).
• From another PC anywhere: type \\studio in File Explorer's address bar.

From a phone

• iPhone and iPad: Files app → ••• → Connect to Server → smb://studio.
• Android: any file manager with SMB support, pointed at the same name.

A NAS makes this better

A NAS is always on, so your files are there even when your computer is asleep. If you have a Synology:

• Install the official Tailscale package from Synology's Package Center. Use it instead of a subnet router.
• Turn off QuickConnect. It's a door into your NAS from the internet. With Tailscale you don't need it, and leaving both on makes the secure path optional.
• Make a personal admin account, stop using the built-in admin, and turn on two-factor login.
• Turn on the firewall: allow your home network and Tailscale, deny the rest.
• Never run a big operating system upgrade on the NAS over Tailscale. You'll lose the connection halfway through.

Just moving one file? Tailscale's Taildrop sends files straight between your own devices, like AirDrop that works across platforms and distances.

• Mac: System Settings → General → Sharing → turn on Screen Sharing. From another Mac: Finder → Go → Connect to Server → vnc://studio.
• Windows: turn on Remote Desktop in Settings → System → Remote Desktop (needs a Pro edition of Windows), then connect with the Remote Desktop app by machine name.
• Linux: SSH, covered in step 9's setup, or Ubuntu's Remote Desktop under Settings → System.
• From a phone or iPad: any VNC or Remote Desktop app, using the same machine names.

Because it all runs over your tailnet, none of these are reachable by anyone outside it.

• Never forward ports on your router. Tailscale is the way in. My router once logged a burst of port scans aimed at my file server. It blocked them and nothing got in, but there's no reason to offer the door.
• If something truly has to be public (an incoming webhook, say), use a tunnel: Cloudflare Tunnel for permanent, Tailscale Funnel for quick tests. Never a router forward.
• One tailnet, with tags and access rules, not separate accounts per project. The access rules (ACLs) say which tagged machines can reach which.
• Make test machines a dead end. Tag them so you can reach them, but they can reach nothing. Anything running untested code shouldn't be able to see your NAS.
• Sharing a machine is not giving a login. When you share your NAS with a collaborator through Tailscale, they still need an account on the NAS itself. Two layers, on purpose.
• Decide early which login owns the tailnet. Moving a tailnet from a personal account to a business account later is not clean.

That's Part 1. Everything you own is connected. Keep going if you want a computer that's always on doing work for you.

Any computer you can leave on works: a desktop that's already always on, a spare laptop (a dead screen doesn't matter), an old Mac mini, or a cheap mini PC. What matters is that it's quiet, sips power, and has a wired Ethernet port.

• If it can run the current Tailscale app on its own OS, keep that OS. Only switch to Linux if it can't, or if you want a dedicated server (step 7).
• Check the exact model before buying parts. On older Mac minis the drive and sometimes the RAM can be upgraded. On newer ones both are soldered, so external storage is the only option.
• Swap a spinning hard drive for an SSD if you can. It's the biggest speed and reliability upgrade for an older machine.
• Plug it into the router with Ethernet. Wi-Fi is the most common reason a home server "randomly" drops off.
• Keep its job list short. A machine with limited RAM can do a few things well, not everything.

For a dedicated server, or an old computer whose OS can't run Tailscale anymore, Ubuntu's current long-term support (LTS) release is the easy default. It gets security updates for years and every tutorial covers it.

1. Back up anything on the machine first. The install erases it.
2. Download the Ubuntu ISO and write it to a USB stick with balenaEtcher.
3. On a Mac: power off, plug the stick into a port on the back, press power and immediately hold Option. Pick EFI Boot. On a PC, use the boot menu key (often F12).
4. Install, set a strong password, and pick a hostname you'll remember, like server.
5. Install Tailscale on it (step 1) and disable key expiry.

On disk encryption: full disk encryption makes the machine stop at a passphrase prompt after every power cut, with nobody home to type it. If the server stores nothing sensitive itself (your files live on a NAS or are backed up elsewhere), skipping it can be the right trade. Decide on purpose.

A computer that sleeps is a computer you can't reach.

• Mac: System Settings → Energy (or Battery → Options on a laptop): turn on "Prevent automatic sleeping" and "Start up automatically after a power failure."
• Windows: Settings → System → Power: set sleep to Never when plugged in.
• Linux: desktop Linux sleeps like a laptop. Turn it off at the system level, not just in settings:

  sudo systemctl mask sleep.target suspend.target \
    hibernate.target hybrid-sleep.target

  Then in Settings → Power, set Screen Blank to Never and Automatic Suspend to Off. If it has a lid, set closing it to do nothing.

SSH first, so you never sit at it again

On a Linux server:

sudo apt install -y openssh-server
sudo systemctl enable --now ssh
sudo ufw allow ssh
sudo ufw enable

From your laptop: ssh yourusername@server. On a Mac server, turn on Remote Login in Sharing settings instead.

Then Docker

Use Docker, with one docker-compose.yml per service in a single folder (I use /opt/stack/) that's tracked in git. Then the whole server is a set of files, and rebuilding it from scratch is: install Docker, clone the folder, start everything. An afternoon instead of a weekend of remembering what you installed.

curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker $USER   # then log out and back in

Install Docker from the official script or apt, not snap. Snap's sandbox fights the folder mounts Docker depends on.

Good first services

• n8n for automations that run on a schedule.
• Kiwix to serve offline copies of Wikipedia, medical wikis and repair guides to any browser on your network.
• Ollama for a small local AI. On my 2014 Mac mini with no graphics card, a 3 billion parameter model produces about 7 tokens (roughly five words) a second. Slow, but fast enough to read along.
• Watchtower or diun to update containers automatically or tell you when updates exist.

• Battery backup (UPS) for the server, the router and the NAS. Short outages stop mattering, and drives don't get cut off mid-write.
• Power back on automatically after an outage, if your machine's firmware or settings have the option.
• Automatic security updates on Linux:

  sudo apt install -y unattended-upgrades
  cat /etc/apt/apt.conf.d/20auto-upgrades

  Both lines should end in "1".

• Being able to reach your files from anywhere is not a backup. If a file is deleted on your home computer, it's deleted everywhere.
• RAID is not backup either. Two mirrored drives protect you from one drive dying, not from fire, theft, ransomware or you deleting the wrong folder.
• Keep an offsite copy. I use Synology Hyper Backup to Backblaze B2. More in the backup guide.
• Back up before you load data in. An unbacked NAS that becomes the only copy of everything is the worst position to be in.
• Your server's setup lives in git (step 9), so the machine is replaceable. Its data is what needs backing up.
• Do one restore test. Pull a single file back from the backup to a different place and open it. An untested backup is a belief, not a backup.

Tailscale needs the internet to set up new connections. If your internet goes out, your devices at home can still reach each other, but only by their local addresses.

• Give your always-on machines fixed local addresses with a DHCP reservation in your router.
• Write those addresses on paper and keep them with your router. Save them as bookmarks on your phone too.
• A battery-powered tablet with Kiwix and copies of the library files works even with no router and no server. That's my last fallback.