Hey everyone. This is probably a super noob question, but I’m very much just an amateur when it comes to self-hosting.
I host several services that I access locally through 192.whatever:####, and when I occasionally need remote access, I use Tailscale and access through 100.whatever: ####. The duplicate bookmarks is mildly annoying though.
Can I just buy a personal domain, and have all my services be coolname.com:#### for both local and Tailscale access? Is that as simple a process as I want it to be?
Edit: I appreciate all the comments and I’ll probably just use Tailacale’s MagicDNS for simplicity, but one or my (unwritten, my bad) goals was to have one URL that works locally and remotely, regardless of Tailscale. I don’t leave Tailscale constantly connected because it overheats my phone (which already has terrible battery life).
You don’t need DNS for this. If you want to use your 192.whatever away from home you can configure tailscale to route 192.whatever to your home network via an exit node.
Its called subnet routing and advertise routes btw. Just in case you wanna search the docs or find it in the cli/app.
This is the best answer, everyone else is making it complicates with DNS and reverse proxies… Exit node, or if you use straight wireguard and set the firewall zone rule on the wirguard PC/device to forwarding and allow masquerading that PC will send out the 192.1680.x.x request like its local.
Look at their MagicDNS for this. It uses the hostname of the system along with your tailnet to allow you to do just this
This is the correct answer. You can even use it to force all the devices in your tailnet to use the same DNS server, and it’s really quite easy to host a sinkhole with either PiHole, AdGuard Home, or my preference, dnscryptproxy. Also works with just the hostname if you want. I.E.
ssh MyLinuxBoxworks just as well asssh MyLinuxBox.whatever.ts.net.If you want the service publicly accessible through the wider internet (the person doesn’t even need TS to access the website), check out TS Funnel.
The downside to the
.ts.netapproach is that you need to install multiple TS clients if you want multiple subdomains. Typically one per service.There are projects like TSD-Proxy that help with that. It makes it so you only use one Docker container instead of having to make a sidecar container for every service.
Then you also have to resolve
*.tailnet.ts.neton your LAN’s DNS and that’s it. Unless you ever want to use something other than Tailscale, that is.
Ooooh. I guess I have some reading to do.
So this definitely seems like the easiest solution, and MagicDNS is on by default, and the normal 100… address works fine, but no combination of the short or full domain seem to actually work. Not homeserver:#### nor homeserver.tail#.ts.net:#### nor even 100.100.100.100:####. Maybe it’s an issue with Unbound or something. Blargh.
Not trying to sound like an ass, promise. Have you declared those routes in Tailscale? There are two methods of doing this. One uses pathing, with
--set-path, and not everything supports serving on a path without changing the base URI of the application you’re trying to reach. It looks like you’re sticking to ports, but I haven’t see anyone ask how you’re declaring this with thetailscale servecommand.And did you add a funnel, or just
tailscale serve?tailscale funnel --bg http://localhost:1234/This is different, and I believe they are mutually exclusive.
The funnel would show as https://hostname.tailnet-name.ts.net/ to anyone online without needing tailscale, and that sounds like what you’re after as far as deduplicating bookmarks. If I’m not mistaken this only supports 443/8443/10000 ports, however. It’s also hanging free in the breeze for anyone to get to if they know the URL.
Again, sorry if this is asking redundant questions or anything.
What are you testing MagicDNS with? What are the DNS settings? What does trying
dog myhost(ordig, or usingabout:networkingin a Firfox derived browser (maybe Chrome too?) if you prefer) tell you? For reference, on a Linux host (I don’t remember exactly, so don’t quote me), you should se something like this in/etc/resolv.confnameserver 127.0.0.1 options edns0 trust-ad search xxxxxx.ts.net xxxxxxxxxx.local.netSo I was doing this from the (emulated?) terminal on my Android phone, and dig just returned command not found. I just got off work and moved to my desktop running Fedora, and on my desktop MagicDNS addresses work. Which I guess narrows things down.
On my desktop, dig returns
; <<>> DiG 9.18.51-dev <<>> toshokun # ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 6364 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 65494 ;; QUESTION SECTION: ;toshokun. IN A ;; Query time: 3960 msec ;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP) ;; WHEN: Sat Nov 14 15:46:41 EST 2026 ;; MSG SIZE rcvd: 37My resolv.conf is pretty similar. The namesever I’m pretty sure is correct for systemd reasons.
nameserver 127.0.0.53 options edns0 trust-ad search tail######.ts.netI appreciate the help, but realistically the answer to “Is that as simple a process as I want it to be?” is no, not quite, at least at my knowledge level lol. I’ll do more documentation reading in the meantime.
Interesting. Does trying to simply ping
myhostormyhost.xxx.ts.network?On Android (well, GrapheneOS) both return temporary failure in name resolution.
Pinging the Tailscale IP (the 100. one) returns 100% packet loss even though opening 100.whatever:#### works in a browser.
Ok, I think I am beginning to understand the issue. Can you try resolving the domain in your browser? If it’s a Firefox derivative, you can go to about:networking, and it gives you the ability to resolve a domain in the browser. Some Chrome based ones should have similar features, but YMMV.
Can I just buy a personal domain, and have all my services be coolname.com:####
It’s actually better. If you get a domain and install a reverse proxy on the server (Nginx Proxy Manager is easy to use) it will help you get free SSL certificates and make subdomain “aliases” so you’ll be able to use
https://service.coolname.com/links. And they’ll have the little shield in browsers and everything.To get the SSL certificates you’ll need an SSL service with an API and access tokens. Most domain registrars are not this fancy unfortunately, but you can delegate your nameservers to a (free) service that can do that. DeSEC.io is a good choice.
You only need this DNS provider to verify the ownership of coolname.com. You do NOT need to put any IP in there.
for both local and Tailscale access? Is that as simple a process as I want it to be?
The Tailscale access is a bit more involved. Here’s the general steps:
- Get Tailscale running on the server with all the services and the reverse proxy. Tailscale will create a network interface with a 100.64.x.x IP address.
- Have the reverse proxy listen on all server interfaces including that 100.64 IP. Generally this should happen automatically. You should be able to see the reverse proxy admin page at
http://100.64.x.x:8081(or whatever the admin port is) as well as athttp://[lan ip of the server]:8081. - In order to reach the reverse proxy over the LAN when you type service.coolname.com you will need to tell your LAN DNS server to resolve
*.coolname.comto the LAN IP of your server. - Next you need to install a small DNS server but this one has to listen only on the Tailscale IP. Dnsmasq is a tiny server you can use for this. You want to configure it to resolve
*.coolname.comto the Tailscale IP (100.64.x.x). - Then you go to the Tailscale admin page under the “DNS” section, click on “Add nameserver”, choose “Custom nameserver”, put in that Tailscale IP, check the “Restrict to domain” box and put “coolname.com” in there.
After that, when you’re at home but NOT connected to Tailscale you will have coolname.com pointing at the reverse proxy via the LAN IP, and when you ARE connected to Tailscale (whether at home or not) it will be pointing to the Tailscale IP and go through the Tailscale VPN. So you’ll be able to use
https://service.coolname.com/all the time everywhere.For my lab I use a reverse proxy and a local DNS server. I recommend Nginx Proxy Manager (NPM) and adguard home for a easy gui.
you can buy a domain (for https that just works) or use the .internal tld reserved for internal use (not over Internet). ex: example.internal.
With a local internal domain: which then you either a) use http b) trust the "self-signed certificates c) create a local root certificate, install a certificate authority that once and use that to sign every websites certificate.
a and b are the simplest. To access websites you set the DNS server as your DNS for each device or point your router and tailscale configs to it.
each service then has a http(s)://service.example.internal that you type in that goes: device > router/tailscale (optional) > adguard > Nginx > service.
for a non internal domain you’d pay yearly or use something like duckdns.org for free. let’s encrypt and self signed is built into NPM.
You may not even need to buy a domain. You could use one like me.internal with something like split DNS - where if you come from your internal network you get one response (internal 192.x.y.z), and when you come from tailnet you get the tailnet addresses. You would need to set your DNS server to this one on your home network and the tailnet, ensure it’s set up to forward everything it doesn’t know you your ISP resolvers or like 1.1.1.1 as you normally have set up. If it’s all private and you don’t want public access then a public domain doesn’t benefit you.
I use pihole (DNS), caddy (reverse proxy), and tailscale (VPN) to host services under names like https://degoog.internal/
happy to give a more detailed description if you’d like
My personal setup is that I have a VPS running Yunohost, with my own domain, so I added it to my Tailnet and set up redirects. So my navidrome server is pointed at https://navidrome.coolname.com/ via my home server’s Tailscale IP.
Works well enough for me, but I don’t know anything about these things, so take my example with a pinch of salt.
<hostname>.ts.netshould automagically work whenever tailscale is on. You might have to enable something.If you want more specific, like sub domain names per service, you can set custom DNS records in tailscale to point to a caddy server which routes to the correct port. The caddy server doesn’t have to be the same machine as the service if its on the tailnet.
Getting https involved is a bit more tricky. You don’t need it because its all over wireguard already, but the browser doesn’t know that and will complain. I think official tailscale can distribute ssl certificates across your tailnet but if you’re using headscale you’ll either need to do that manually or buy a domain and have caddy auth for that domain.
I just bought a domain an hour ago. If you don’t care about the name you get a very cheap .xyz domain if it has only numbers. Look at https://news.gandi.net/en/2017/06/introducing-the-1-111b-class-of-xyz-domains/
I’m not sure with Tailscale, but in Netbird that’s pretty easy if you already have DNS setup on your local network.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters AP WiFi Access Point DNS Domain Name Service/System ISP Internet Service Provider IoT Internet of Things for device controllers PiHole Network-wide ad-blocker (DNS sinkhole) SBC Single-Board Computer SSH Secure Shell for remote terminal access UDP User Datagram Protocol, for real-time communications VPN Virtual Private Network VPS Virtual Private Server (opposed to shared hosting)
10 acronyms in this thread; the most compressed thread commented on today has 17 acronyms.
[Thread #169 for this comm, first seen 14th Nov 2026, 22:20] [FAQ] [Full list] [Contact] [Source code]
You could do that, but you’ll need to employ some kind of DNS tuning so that:
- If you query for the domain from the LAN range, it responds with 192.whatever, and
- If you query for the domain from the Tailscale range, it responds with 100.64.whatever
The terminology for this is “split DNS” or “split horizon”. You can do this by selfhosting two DNS servers - one for the LAN and one for the Tailnet - with different records for the domain. You can selfhost the same DNS server on both the LAN and the Tailnet, and configure some rules so it answers differently based on the querant’s IP. Found this guide for Pi-hole. Technitium also works for this with its Split DNS app, but it’s a steeper learning curve.
Furthermore, if you don’t wanna pay for a domain, just use one of the free dynamic DNS services. https://afraid.org/ is one of them.
Alternatively, why not always connect to the Tailscale address in the first place? Tailscale probably run as an always-on VPN on your client device anyways, and you can reuse the address in the same LAN.
Yes.
I also used this tool (https://github.com/canon2k5/tinyhome-py) to make a dashboard that points to all my services. You have to manually update it when something changes, but it’s made onboarding my partner much easier.
Also; I went for drive.customdomain.com, Jellyfin.customdomain.com, etc.
Can I just buy a personal domain, and have all my services be coolname.com:#### for both local and Tailscale access? Is that as simple a process as I want it to be?
Yes you can, and it could be even simpler for you. You can get Caddy working and give each service its own address, (service).coolname.com no need for port number. Than you tell caddy what IP addresses it can host out to. But even if you did not want to buy a domain, you can still use caddy with some made up address.
If you only have a few services running I am sure you could continue running the port numbers but I much prefer using caddy.
Wouldn’t it be unsafe to expose to the internet like that?
Tl:dr:
- I use the non-typical LAN IP range, with odd numbers. With lots of vLANs and VPNs.
- I turn off port 22 if it does not need SSH access and if it does I change the port number and turn off password authentication and use keys instead.
- I have a kick-ass firewall with lots of rules and vLANs and a few VPNs.
- I have a honeypot for bots that gets logged with crowdsec.
- I have numerous wifi APs so devices stay in their lane.
- I annonomize my email for less tracking.
- I have a finally tuned pihole system set up, so much so that I cannot read an Arstecnica (I think it is) free article for another 100 years or something like that.
- When someone points something out that I am over looking I research about it and than find a way to fix the issue
- I do my best to not become the product by giving my information out just willy nilly.
- I look for self hosted options rather than ones that track me.
- I am moving away from Apple and into FOSS including Linux
- The only Google service I use now is youtube but that is with all the ads and tracking cut out.
Of the services I run I only have a few things exposed directly to the WAN, one comes from my LAN but redirects it to my VPS which hosts my blog (blog.reannlegge.ca). Fairly sure that is the only service that ordinary people can access from the VPS, and I personally do not remember if anything other than my domain name goes out from my homelab that is not connected to a VPN other than regular internet stuff which uses DoT.
I have a Flint2 with a vanilla install of openWRT and a poop load of vLANs, and a a few VPNs. Before I really got into the lifestyle of homelabing I made the booboo of trusting my ISPs firewall for stuff, fast forward several years when I decided to jump right into the deep end, instead of tip toeing deeper and deeper into homelabbing the first thing I should have done was get the Flint2 but instead I decided to get my first 2 static IP address (from my ISP). I was planning on hosting my own email but I found that this was not the best idea; if I wanted to keep my hair so I only use 1 of the 2 static IPs that my ISP provides at this time, the third static IP is my VPS.
The booboo I made tip toeing into homelabbing was opening my network up on port 22, so now the first thing I do when I connect anything to the internet is change its ssh port turn password authentication off and only use keys, the only things on my network that have port 22 open is my firewall so it can forward bots to my honey pot on its own separate vLAN (10.13.37.0) that I keep separated from everything else, but still you cannot ssh into the firewall without the key and the bot is logged with crowdsec, I am sure if someone join’s one of guest networks they could have port 22 open on there device but it is blocked on the firewall for that vLAN. Everything on my IoT vLAN (10.66.6.0) does not have access out to the WAN, but I can look at it all from anywhere via HomeAssistant on my home lab vLAN (10.0.69.0), feeling real mature setting that one up! Then my personal vLAN (10.42.0.0) and my personal VPN (10.42.69.0) can see everything in my home lab vLAN and the traffic to the LAN uses DoT. The guest vLAN (10.4.20.0 I think) and the kiddo vLAN (10.6.7.0) can only see out, and not see into my other vLANs, through whatever port DoT goes out through I wanna say 863? I think it is either that or just 443. Than I have 1 or 2 other VPNs, I plan to add another soon so I can leave a pi at my fathers place for an off site back up of some things on my LAN encrypted differently than my other off site back up. I have rules set up for web browsing to come in only on 443 rather than 80 if it is not coming in via DoT and it all goes through my pihole set up first. I choose the 10.0.0.0 range rather than the 196.0.0.0 or 172.0.0.0 range for security, it is far more unlikely that I will run across the 10.0.0.0 when on public wifi than the other two making it far easier for me to connect to my wireguard VPN. Security through obscurity and a fair bit of paranoia, and previous experience (do not leave port 22 open kids).
The Flint 2 can do a bunch of wifi and fire wall stuff that my old Apple Airport extreme could do, so now it sits in a closet plugged in with two APs that connect to nothing one quoting yoda “do or do not” and one quoting Obi-won “use the force” my active SSIDs are; NRC Appliance Devision, for my IoT stuff. Canadian Coast Guard Outpost, for my guest SSID (I live in Saskatchewan a landlocked province of Canada). Service Canada Youth Allowance, the kiddo guest wifi. CBSA Amnesty Bin 407, for my personal wifi. I have QR codes on my fridge for the two guest wifi APs. Just for fun my phones hot spot is CSA Orbital Debris Tracker, but it wireguards into my vLAN at home. I have a QR code somewhere in my phone for the other two guest VPNs, if I need them I guess OpenWRT also shares QR codes for the VPNs so I could log into it to share out guest VPN access.
Then you want to know about my email hygiene to prevent bad actors getting in that way? I use a different email address for everything, (service name)_(local slang)(three random numbers)@reannlegge.ca. If something gets spammy I can either bounce the email or silently delete it, or send it to my trash so that I can still see that it came through, if I need to extend the free trial just a little longer I can also just create a new account with a new email I have only done that once or twice. Sure I could continue to use my gmail email with the +function so reannlegge+service@gmail.com to stop spam but that is only stopping one devil while still letting one of the biggest in. While I was still using my ISPs email service I had paid for a year for one of those we will delete you from data broker scam systems but that was years ago before I started using individual email addresses for everything.
Than you want to know about my internet security? I use a pihole system with unbound directed to CIRA, I thought that was plenty secure enough until yesterday when someone informed me about how that still does not stop people from looking into my web traffic so I spent several minutes researching ODoH to find out it did not work with pihole than more researching DoH which again I found out does not work with pihole but than I spent several hours researching and implementing DOT because it does work with pihole. I could have dropped pihole and gone with ODoH, as it supposidly has some ad and tracker blocking but my pihole does so much more than just ad and tracker blocking. I have my pihole tuned up fairly close to a 10 out of 10.
If it is a web service I want to use first I look for a way to self host it, or something similar. Even though I have very high security only the parnoid survive. I have not ridden the bus for well over a decade approaching 2 until yesterday, rather than using the transits app I built my own for watching for buses. Sure the transit system can still track me using the tap card but what is that linked to? An email that is only used for the transit system, so they only know what buses I get on. Yesterday I was so annoyed that I was going to get on the bus and see all the ads along the top but there were none, bus fairs are not that expensive and there is no way that the taxes are going to pay so much to take care of it. Only one thing remains they are selling info to data brokers, which I do not care about because that is how the world works today, they are just not getting much from me.
I used to be a huge Apple fan girl but I have stopped that, if I had the money I would be replacing my ipad with something I could install Debian on. I am looking at replacing my phone with a pixel 10 and installing GrapheneOS on it soon, I was considering waiting for the Motorola phone next year but cost may be a bit much. When I was getting into smart home stuff, it was well before privacy became a goal in my mind so I was fine using AppleHome kit, when there was something I wanted to use that was not compatible with Apple’s walled garden I installed homebridge on one of my pi’s. I had raspberry pis because I was starting to get into security with pihole. The damn finally broke when Trump came into office and threatened to annex Canada I started moving services away from the big US tech and coming to Canada, I was no longer going to use Apple’s services so I went to Proton, but the CEO quickly got down on his knees for Trump so that was a nope for me. I came to Canada and orginally sold an arm and a leg to host my blog and email with HostHero but that relationship soured after a few years so I moved my domain over to easyDNS and there email service offers a wildcard option so I can create random emails on the spot rather than going to the page and setting up a new address. I found an old 2014 Mac mini and installed Debian on it to host my arr stack and Jellyfin on it, it does much better than pi 5 was doing. I had a pi 4 that I installed HAOS on got ride of AppleHome Kit entirely excluding 2 homepod minis, I am looking for something good to replace them with. I am hoping to get a hand me down Mac mini in a few days so I can install Debian and have a useable media centre PC currently I have a pi 5 and it doesn’t do to good with it.
I used to “just google it” but than Trump made his threats and I switched to ecosia, which I know is just Bing with a pretty mission statement but it was hosted out of the EU somewhere. As I got more comfortable with self hosting I switched to searXNG which I have setup to pull info ftom Bing, wikiepedia, and a few other engines I know it is still Bing without the pretty mission statement, but it also comes with no tracking!
So I play it safe on the internet!
Feeling safe on the internet is the first step of beeng fried from the Internet.
So you should add a part about Backups…
Well yes I have backups I wish I could say I follow the 3-2-1 rule but I am following more of a 2-2-1 rule for things that cannot be recovered if lost. My aim is to have a 2-2-2 setup next week hopefully.
@Reannlegge @selfhosted Truly, an epic post. Lots of good ideas here! You reminded me of a few things I’ve overlooked. I’m in the process of subnetting and VLANs and all the rest. It’s making my IoT devices crazy but eventually things will settle down. One thing you didn’t mention was printers. I am super paranoid about them. A few years ago somebody zombied mine and used it to attack my other devices from the inside! I eventually won that battle. Now I just leave the printer off and disconnected from the network unless I am going to print or scan something right then. You also didn’t mention Bluetooth. Last time I did a scan for devices it found over 200, all but a handful not mine. Anyway, thanks for posting. <<Hold the door!>>
@matsefi@lemmy.liebeleu.de reminded me to mention back up and I would love to say I follow a 3-2-1 practise of irraplacable things but in all realities it is only a 2-2-1 of those things. I am really hoping to be able to do a 2-2-2 setup soon! I am already part of the @selfhosted communite and I have taken on a lot of things that I have found in there, this is just my security stuff, I feel pretty safe but in no way am I locked down! Some things I was already doing as I was getting away from the Google and Apple, after Trumps 51st state BS. If you wanted to get into my docker stack that is another story I have docker running across 2 pi 5’s and a 2014 Mac Mini running Debian I am sure I have containers with services I have forgotten about I would have to look through my notes to find out what they are doing, take notes so if something brakes you can figure out what was why. I am certain it was in the selfhosted group that I learnt about docker and fell for it, it took me some time to warm up to it because I had tried portainer in the past and did not have a good time but once I did I do not like running things bare metal.
I have never attached a printer to the internet, for the same reason why I do not connect my “smartTV” to the internet (well it was once because the friend who was helping me out she wanted me to do it, when I came back home from taking her back to her place this girl disconnected it and it took me a while to figure out how to stop it nagging at me to connect it but months (probably) down the line I got it to stop. Like I had said I idiotically like a dumb dumb opened up port 22 on my ISPs joke of a firewall and messed my LAN right up I had thought it was my internet acting real slow so I called up my ISP, and they asked why I had that opened up turns out it was not the internet being slow it was the internet working how the internet of the early 2010’s worked and my network was being flooded with bots and other things saying hello, I had almost entirely only Apple things on my LAN back than so there was not to much harm, just needed to do a clean reinstall of the OS on my laptop and desktop, reset all my devices you know the whole I was in a rough place thing and glad I had back ups of everything important place. Today I would have been right messed up sure I am replacing all my Apple stuff with Linux stuff but still the poop would not be out of my LAN ever I am sure. I have crowdsec running on things with healthchecks (healthchecks.io) and ntfy to notify me if any thing has broken through, I started my transition to HA long before I set up the vLANs so the devices do not complain to terribly much. It was funny when I deciding what computer or SBC was to do what I decided my remaining pi 4 would work as my smart home hub I spent a lot of time trying to see how I would set it up to run both HA and Home Bridge (the stricktly HomeKit version of HA), but I just decided flux it I am going HAOS, and have not missed home bridge once.
On the topic of HA, an app that I used to use to nag at me to pop my pills/jab a needle into me decided that just because I paid for it when it launched does not mean you get to keep using it for years and years without getting a subscription. I have more than 3 or whatever the amount of drugs they offer on no subscription stuff, even if it was just 3 I could have set it up so that it was reminding me to do my drugs at the times but I have more than 3 drug schedules so I said heck with this poop and set up reminders in HA to send my phone or watch messages to do stuff at certain times of the day, week, month, or even year. Sure for the monthly and yearly stuff I also have calendar events on calendars self hosted with baikal (which also hosts my contacts). Prior to baikal I was using Nextcloud but I thought it was trying to do to much and failing so I stopped trying, so Nextcloud became one of those services I forgot about I am trying to get back into it for file sharing rather than smb.
I did not mention my printer because I over looked it as a security spot. Like I use different email addresses for everything, just like I use different unique ports for everything I can (away from the 8080 range that homelabers typically start with) CUPS is the only service I cannot seem to figure out how to change without it freaking the flux out and not working, I am sure I could do it now with docker but it is working good on the CUPS port with HTTPS now so I do not dare try to move it. SANE was cool with it but CUPS not so much. So I use CUPS on one of my pi 5’s to make my printer accessible over the internet/wifi and SANE to make the scanner accessible over the internet/wifi. Sometimes I see someone’s printers wifi around my place and I consider just going into it and printing out instructions to make it safer, but I always talk myself out of it. I am sure there is a poop load of bluetooth thingies around my place but I do not join them and nothing on my network auto joins bluetooth things that I have not set up. I was using CUPS long before I thought security was cool so I had not started using homebridge or HA but I am sure I could have set homebridge up to act as a printer share, I know I can set up HA to do it but I am cool with CUPS. The reason why I use CUPS has changed over the years, when I started it was because it could print the last page first and the first page last so I was not juggling pages for my high school papers, when I got my own printer it was because the printer did not have up to date drivers for OS X, the third time was because the printer wanted me to set it up with samsung servers so it could “remind me” and I am sure it is not to spy on me to sell me to data brokers /s to get new cartrages for the laser printer. In the very near future when I get a new printer because it would be less expensive to get a ink jet with the refill bottles than it would be to get the cartridges I will use the excuse of being able to set a script to print something once a week to keep the heads from drying out, I believe I currently have a script to print out the documents my insurance company wants to see every quater to see if the physio treatments are doing there job. So like you I do not connect my printer to the network per-say but I can still use it as if it was.
I just use the zerotier vpn option to route all local ips through my home lan, so 192. domains are always reachable. Can’t tailscale do that?
