Tailscale
With Tailscale, you can reach Jeedom at home or on the go — while keeping it completely private.
- No ports to open on your router, Jeedom is not exposed to the Internet.
- Access restricted to the devices you authorize.
- Secure HTTPS connection, to enable and configure in Tailscale.
- No domain name to buy or renew.
- No complex Internet setup — Tailscale handles everything.
- One consistent address to reach Jeedom, whether at home or away.
- Works on 4G/5G and with routers that have no static public IP.
- Compatible with phones, tablets and computers running the Tailscale app.
Tailscale must be installed and connected on every device you use to access Jeedom remotely.
What does the plugin do?
The plugin connects Jeedom to your private Tailscale network, called a tailnet, and monitors your connected devices.
Secure remote access — Access Jeedom from outside without port forwarding on your router, in most configurations. Tailscale creates an encrypted private network between your devices.
Private HTTPS access (Serve) — Jeedom gets an HTTPS address with an automatic certificate (e.g. https://jeedom.tail1234.ts.net), accessible only from your Tailscale devices. Useful to secure access without managing certificates, or as an alternative independent of your usual DNS or reverse proxy.
Public access (Funnel) — The same address made accessible from the Internet, even without Tailscale on the visitor's side. Useful for sharing Jeedom access with someone who doesn't have Tailscale, or for third-party services that need to reach Jeedom (webhooks, voice assistants). Activation and permissions are configured in the Tailscale console.
Local network access — From a smartphone, tablet or PC connected to Tailscale, reach devices on your local network (NAS, camera, printer…) without installing Tailscale on each of them. Subnet Router mode lets you share an entire subnet (192.168.1.0/24) or a single device (192.168.1.40/32). System routing and permissions must be configured.
Device monitoring — Each device visible on the tailnet becomes a Jeedom equipment with its online status, address and alerts. Latency is measured during a ping, not continuously. Use this information in your scenarios and notifications.
To get started, simply connect Jeedom and your phone to Tailscale. OAuth configuration and advanced features are optional.
Tailscale provides an alternative access if your usual address or reverse proxy stops working. Jeedom must however remain powered on and have an Internet connection, as must your phone. Tailscale does not replace a broken Internet connection and does not switch over automatically.
Before you start
- Jeedom 4.4 or higher, on a compatible system, Debian 11 to 13.
- A Jeedom administrator account to install and configure the plugin.
- A working Internet connection on Jeedom.
- A Tailscale account and the Tailscale app on the phone or computer used remotely.
Dependency installation requires the usual Jeedom system rights. You do not need to configure port forwarding on your router for the steps described here.
First connection
1. Install and enable
In Plugins → Plugin management, install Tailscale from the Market, then enable it.
In the plugin configuration, wait for dependency installation to complete. If it does not start or dependencies remain in error, launch their installation from this page. Dependencies install the Tailscale software required on Jeedom.
2. Connect Jeedom to Tailscale
In the plugin configuration:
- Click Connect to Tailscale.
- Open the authentication link displayed.
- Sign in to the Tailscale account that should host Jeedom and confirm the addition.
- Return to Jeedom: the status should become Connected.
If the status shows Awaiting validation in admin console, approve Jeedom in the Tailscale console.
3. Connect your phone and test
- Open the Tailscale app on your phone and connect it to the same Tailscale network.
- Enable the Tailscale connection.
- To test real external access, turn off the phone's Wi-Fi and use 4G/5G.
- In the browser, open the address shown in Access to Jeedom via the tailnet, for example
http://100.101.102.103. - Sign in to Jeedom with your usual credentials.
Use the address actually shown by your plugin. If your Jeedom installation uses a specific port or path, keep it in the address.
The MagicDNS name, when available, lets you replace the IP address with a more memorable name. For an HTTPS address with an automatic certificate, see Enable Serve.
4. Create Jeedom equipment
Open the plugin's main page and click Synchronize. The plugin creates or updates one equipment per device visible from Jeedom in Tailscale, including Jeedom itself.
Synchronization is for monitoring: it is not required to open Jeedom remotely. It does not install Tailscale on other devices.
A missing device is reported offline; its Jeedom equipment is not automatically deleted. The Enable and Visible settings of your equipment are preserved.
Finding your way around the plugin
| Button | Purpose |
|---|---|
| Synchronize | Add known devices and update existing equipment. |
| Configuration | Connect Jeedom, fill in options and, if needed, OAuth credentials. |
| Health / Diagnostic | Understand the connection status and troubleshoot. |
| Administration | Manage devices and access the Subnet Router and Serve / Funnel tabs. |
Using equipment
Open an equipment to give it a name, assign it to a room, or choose its visibility on the dashboard.
Auto-refresh sets the update frequency. Leave this field empty for a refresh every minute, or use the ? assistant to choose another frequency. Examples: */5 * * * * for every 5 minutes, 0 * * * * for once an hour.
Understanding the information
| Information | Meaning |
|---|---|
| Online | Known connection status of the device. There may be a delay before a change becomes visible. |
| Tailscale IP / IPv6 | Addresses of the device in the Tailscale network. |
| Hostname | Full name of the device in Tailscale. |
| OS | Device system: Linux, Windows, Android, etc. |
| Last activity | Last known contact; this is not a presence indicator at home. |
| Direct connection / DERP | Direct path between devices or via a Tailscale relay. A relay is not a failure. |
| Latency | Response time of the last Ping test, in milliseconds. |
| Authorized | Device authorization in Tailscale, populated through OAuth. Without this configuration, do not use it as proof of an access denial. |
| Key expiry (days) | Remaining time when an expiry is known. 0 means expired; -1 means no expiry set. |
Some information is hidden by default. You can choose which to display in the Commands tab.
Hidden commands remain usable in Jeedom scenarios. For example, Direct connection (direct) lets you know if two devices communicate without a relay, DERP shows the name of the relay used, and Tags lists the device's Tailscale tags.
Useful actions
- Refresh updates the known information for the device.
- Ping tests the device's response and updates latency when it responds. Latency is not measured automatically at each refresh.
- Authorize / Deauthorize, in the equipment commands, grant or deny the device on Tailscale. These actions require OAuth and administrator rights.
The Enable checkbox on the equipment page concerns its tracking in Jeedom. The Authorize command concerns its authorization on Tailscale. Deauthorizing a device on Tailscale does not turn it off or cut its regular Internet access.
The Jeedom equipment, marked "Self"
Self refers to the machine running this Jeedom. It has additional information:
| Command | Meaning |
|---|---|
| Status | Tailscale service status: Running, NeedsLogin, NeedsMachineAuth, Stopped, etc. Usable in a scenario to detect a connection issue. |
| Devices online | Number of devices currently connected to the tailnet. |
| Exit node active | Indicates whether Jeedom is acting as an exit node for other devices. |
| Subnet router active | Indicates whether Jeedom is advertising subnets. |
| Update available | Signals that a new version of the Tailscale software is available on the machine. |
Its Connect and Disconnect commands control Jeedom's connection. The Update command, hidden by default, concerns the Tailscale software installed on the machine; plugin updates remain managed by Jeedom.
If you use Tailscale to access Jeedom, Disconnect will interrupt that access. In the configuration, Leave tailnet (logout) then requires a new authentication. Perform these operations when you also have local access.
Options and notifications
In Configuration, you can enable Automatic equipment creation to integrate newly detected devices. Otherwise, use Synchronize after adding them to Tailscale.
The Machine name on the tailnet field is used during key-based authentication. Changing it alone does not immediately rename an already connected machine.
The Jeedom message center can notify you of:
- authentication to renew or a device awaiting approval;
- a node removed from the tailnet (re-authentication required);
- a connection issue with the Tailscale coordination server;
- new devices appearing on the tailnet;
- alerts raised by Tailscale;
- an equipment key expiring soon: a reminder at 14 days, an alert at 3 days, then at expiry.
To avoid overwhelming you, status notifications are sent at most once per hour and expiry alerts once per day.
On mobile
The plugin's Jeedom mobile panel displays enabled equipment that your account has the right to view. You can filter online or offline devices, open their details and trigger a refresh or ping depending on your rights.
The display reloads every 30 seconds. It shows the last known values; the collection frequency remains that of the equipment. Authorization actions are reserved for administrators.
Example: monitoring a remote device
In a Jeedom scenario, use Online to track a device, then send a notification if it remains offline for several refreshes.
To track response time, run Ping periodically and use Latency. Only Online status is historized automatically at creation. For a latency or online device count graph, manually enable historization of these commands in the Commands tab of the equipment.
A phone in sleep mode may not respond immediately. A ping with no response does not necessarily mean the device is off, and the displayed latency may remain from the last successful test.
Going further
| Your need | Feature |
|---|---|
| Open Jeedom over HTTPS from your Tailscale devices | Serve |
| Reach a NAS or camera without Tailscale installed on it | Subnet Router: local network access |
| Make Jeedom's address accessible without the Tailscale app | Funnel: public access |
| Authorize devices or manage their settings from Jeedom | Administration with OAuth |
| Look up the tailnet DNS name or enable MagicDNS | DNS |
Health / Diagnostic
The Health / Diagnostic button opens a modal that gathers the plugin status in five sections:
| Section | What it checks |
|---|---|
| Service | The tailscaled daemon is active and its socket is reachable. |
| Network | Tailscale IPv4 and IPv6 addresses, MagicDNS status, UDP and UPnP availability. |
| Connectivity | Direct connection (peer-to-peer) or via a DERP relay, with its latency. |
| Routing | IP routing status (IPv4/IPv6), subnet router and exit node. |
| Health | Summary: installation, authentication, tailnet connection, OAuth API and any Tailscale alerts. |
The OAuth/API test is run separately and does not block the rest of the diagnostic. If the API is slow or not configured, the other sections remain available.
A green tick indicates a nominal state. A red cross signals an issue to address. A dash or "Unknown" means the information could not be retrieved, which is not necessarily an error.
UDP and UPnP help Tailscale establish direct connections between devices. If one is absent, traffic goes through a DERP relay: everything still works, but with higher latency. It is generally not necessary to change your network for this.
The plugin also provides a summary in Jeedom's Analysis → Health, which includes the status of access to the Tailscale system log. If access is insufficient, the Health page indicates this with instructions. You can fix permissions from the plugin configuration, under Advanced diagnostic.
Troubleshooting
| Situation | Check first |
|---|---|
| Dependencies in error | Re-run their installation and check the tailscale_update log. |
| Authentication required | Click Connect to Tailscale and follow the link. |
| Link not displayed | Check Internet on Jeedom, then try again. The connection attempt lasts about three minutes. |
| Awaiting validation | Approve Jeedom in the Tailscale console. |
| Stopped (down) | Try Reconnect (up). If it fails, check the diagnostic and the tailscale log. |
| Connected but Jeedom unreachable | Check Tailscale on the phone, the correct Tailscale network, the address and access rules. Also test Jeedom locally. |
| Name not working | Try the displayed Tailscale IP. If it works, check MagicDNS in the Tailscale console. |
| API not configured | This is normal if you are not using OAuth device management. Remote access still works. |
| DERP relay or UPnP absent | This is not necessarily an error. Test real access before changing your network. |
| IP routing disabled | This setting concerns gateway features. It is not required to access Jeedom only. |
| Node removed from tailnet | If Jeedom was removed from the tailnet (via the Tailscale console or by expiry), the plugin prompts you to re-authenticate. Click Connect to Tailscale in the configuration. |
| Coordination server unreachable | Check Jeedom's Internet connection. If the network works, the issue may be temporary on Tailscale's side. |
| Insufficient log access | The Health page indicates whether the plugin can read the Tailscale log. If access is denied, use the Advanced diagnostic section in the plugin configuration to fix permissions. |
| Permission denied | Re-run dependencies to restore the rights set by the plugin, then check tailscale if the error persists. |
Logs are accessible from Jeedom. For a support request, provide the status, the exact message and the plugin version. Do not include your keys or OAuth secret.
Removing the plugin
Removing the plugin does not uninstall the Tailscale software from the machine. Its connection may therefore continue to work. To also remove that access, plan a system intervention with local access and check the uninstallation messages.
See the changelog for the version history.