Given that Tailscale support within Channels has been discontinued, these instructions will help you configure a Tailscale service to access Channels from a unique Tailnet IP or hostname. Put simply, this will allow you to go to: https://channels.your-tailnet.ts.net using full HTTPS as well as access your DVR from any remote client using the same domain. When doing so, you'll just want to make sure you don't prepend HTTPS. It will resolve the IP address over Tailscale's magic DNS in the end, and you'll want to choose at home rather than away from home, given that away from home is meant for forwarding the port out.
The instructions are as follows:
Step 1: Create a tag for your server
Admin console > Access controls > Tags > Create tag. Name it after the machine hosting Channels (for example unraid or nas), leave the owner as autogroup:admin, and save.
The tag identifies the server. channels is the name of the Service, which you'll create in Step 3. Keeping them separate means one tagged server can host several Services.
Step 2: Tag the Channels DVR host
Machines > ⋯ on your Channels DVR host > Edit ACL tags > add your tag (for example tag:unraid) > Save.
Services only run on tagged devices, not ones signed in as a user.
Step 3: Define the Service
Services > Advertise > Define a Service.
- Name:
channels - Ports:
tcp:443, tcp:8089
Step 4: Run the serve commands on the Channels DVR host
tailscale serve --service=svc:channels --tls-terminated-tcp=443 tcp://127.0.0.1:8089
tailscale serve --service=svc:channels --tcp=8089 tcp://127.0.0.1:8089
- 443: Tailscale terminates HTTPS with a real certificate and passes the raw connection to Channels.
- 8089: plain pass-through on Channels' native port.
Use these TCP forwards, not --https / --http. The HTTP modes add an X-Forwarded-For header with the client's Tailscale IP, which makes Channels think you're away from home. Raw TCP forwarding doesn't, so Channels treats tailnet clients as local.
In each command, the first port must match a port from Step 3. The 127.0.0.1:8089 destination is Channels on localhost.
Use sudo on Linux/NAS, or an admin terminal on Windows. For a containerized Tailscale, run them with docker exec. The config survives reboots.
If the Service shows "some required ports are missing," one of the commands didn't take. Check with tailscale serve status.
Step 5: Approve the host
Services > channels > Service hosts > Approve.
Step 6: Connect
Channels won't auto-detect the Service, so add it manually in the Channels apps:
- Host:
channels.<your-tailnet>.ts.net - Port:
8089
In a browser, https://channels.<your-tailnet>.ts.net also works.
Since Channels sees these connections as local, anyone with access to the Service on your tailnet gets in-home access. If you've replaced the default access policy with your own rules, you'll need a grant allowing your users to reach svc:channels on ports 443 and 8089.
Undo
tailscale serve clear svc:channels
Then delete the Service in the admin console.