Reach your Hub from your phone
Get your Hub dashboard open on your phone from anywhere, over a private network only your devices can see.
Time: ~15 minutes · You’ll need: your Hub running, a phone, and a Tailscale account (free)
What you’ll have at the end
- Your Hub reachable from your phone on mobile data, not just home Wi-Fi
- No ports opened on your router and nothing exposed to the public internet
- The same private address working from any device you add later
This is the private option. If you want an app reachable by people who are not on your devices — a public link you can send someone — use the Cloudflare Gateway instead.
How Hub runs Tailscale
Hub ships a Tailscale sidecar container (hub-tailscale) under the private-vpn compose profile, enabled by default. It joins your tailnet and advertises the Docker bridge network, so your other devices can reach the Hub network rather than just the one container.
You do not install Tailscale on the Hub machine yourself for this path — the sidecar is the supported route. Running Tailscale on the host instead is covered in Tailscale Private Networking.
Connect your Hub to your tailnet
In the dashboard, go to Settings → Network & Connectivity and start the Tailscale connection.
Hub runs tailscale up inside the sidecar and hands you back an authentication URL. Open it, sign in, and approve the machine. If you already started this during the Onboarding Wizard, it’s already done.
Prefer an unattended setup? Set TAILSCALE_AUTHKEY in your Hub .env to a
pre-auth key from your Tailscale admin console and the sidecar joins without
the interactive step. See Environment
Variables.
Confirm the Hub joined
Back in Settings → Network & Connectivity, Hub reports its Tailscale state — whether it’s connected, the tailnet it joined, its hostname, and its Tailscale IP (a 100.x.y.z address).
Write down that IP. It’s how you’ll reach the Hub from every other device.
If the panel says Tailscale isn’t available, the sidecar isn’t running — the
private-vpn profile can be disabled with PRIVATE_VPN_USER_DISABLED=true.
See Sidecar Not
Available.
Install Tailscale on your phone
iPhone / iPad
Install Tailscale from the App Store, open it, and sign in with the same account you used for the Hub.
The account is what matters — devices only see each other inside the same tailnet.
Turn the VPN on
Toggle Tailscale on in the app and accept the VPN permission prompt your phone shows the first time.
Your phone now has its own 100.x.y.z address and can talk to every other device on your tailnet.
Open your Hub
In your phone’s browser:
http://100.x.y.z:5002Substitute the Tailscale IP you noted in step 2. You should get the Hub login screen — the same dashboard as on your desktop.
Add it to your home screen and it behaves much like an app.
Prove it works away from home
This is the step people skip, and it’s the only one that actually tests anything:
- Turn Wi-Fi off on your phone so you’re on mobile data
- Reload
http://100.x.y.z:5002
If it still loads, you’re genuinely reaching your Hub over Tailscale and not just over your home LAN. If it only worked with Wi-Fi on, you were talking to the Hub directly the whole time and Tailscale is not actually carrying the traffic.
Reaching your apps, not just the Hub
The dashboard is on port 5002, but your installed apps are elsewhere. From your phone on the tailnet, an app is reachable at the Hub’s Tailscale IP plus that app’s port — the port shown on the app’s card in the dashboard.
http://100.x.y.z:8301Hub can also publish apps through Tailscale Serve, which gives them proper hostnames and HTTPS inside your tailnet instead of bare ports. That path has extra prerequisites — your tailnet needs HTTPS certificates and MagicDNS enabled — and is documented in Accessing Apps over Private VPN.
If it doesn’t work
| Symptom | Cause |
|---|---|
Phone can’t reach 100.x.y.z at all | Tailscale toggled off on the phone, or the phone signed into a different account than the Hub |
| Works on Wi-Fi, fails on mobile data | You were reaching the Hub over your LAN; the Hub’s Tailscale connection is not actually up — recheck step 2 |
| Hub panel shows no Tailscale IP | The sidecar isn’t running or hasn’t authenticated — see Sidecar Not Available |
| Dashboard loads, an app doesn’t | You’re using the wrong port; take it from the app’s card. Apps are not on 5002 |
Deeper troubleshooting lives in Tailscale Private Networking.
Next
- Cloudflare Gateway — for links you can send to other people
- Tailscale Private Networking — host installation, Serve, custom routes, pre-auth keys