Tailscale, Docker, Pi-Hole, Mac Mini, NAS and Cloudflare

[tekguru]

There had been a lot of posts lately concerning remote access to the NAS when hosting Pi-Hole on the NAS with an 'entry' via a custom domain and Cloudflare.

It all worked well for me via Cloudflare using a CNAME DNS record to point at my QuickConnect ID on the NAS then using a reverse proxy to hit Pi-Hole.

The issue I found was that Pi-Hole used up way too many resources on the NAS.

So I decided to off-load the Pi-hole system on to my old Intel Mac Mini which was out of use. So Docker was installed and Pi-Hole set up. Tailnet is installed on the Mini so I could access Pi-Hole at mypinhole.mytailnet.com and using the tailnet Pi-hole IP as the Tailnet nameserver. It all worked apart from :

• Only accessable via a Tailnet device (no real problem there)
• I could not access it from outside of Tailnet as there were HTTPS errors as I was no longer going in via Cloudflare and using their Origin Certificate.
• Pi-Hole as it sat on top of Tailnet only showed one client which had the Tailnet host IP.

All well and good but I wanted more......

I've now installed Pi-Hole into Tailnet using a Tailscale Sidecar container in Docker on the Mini, and that solves the issue of the IP addresses, I get all the machines using the Tailnet showing the Tailscale client IPs.

But this bypasses the NAS so it can't be accessed via my third-party domain using HTTPS.

Solutions look to be install a system called Unknown on the Mini (again using Docker) which will manage certificates etc.I really don't want to use yet another container

My preferred solution would be:

• Still use Cloudflare DNS so I can use a sub-domain as I had previously. That gives me the HTTP certs, plus I can use a Cloudflare rule to change the port from 80 to the Pi-Hole admin port
• The router takes the Pi-Hole admin port and forwards that to the NAS
• The NAS has a reverse proxy (incoming HTTPS, subdomain, port 80), destination HTTP, <hostnamer>, port 8080

The problem is (I think) the <hostname>, I've tried:

• The local IP LAN address of the Mac Mini (192.168 etc)
• The Tailnet IP address of the Tailscale Sidecar (100,100, etc) **
• The Tailnet Tailnet name of the Tailscale Sidecar (pihole-sidecar.mytailnet.com)**

** - As Tailscale is installed on the NAS and Minni I'm assuming cross networking between the LAN Tailnet can work?

Anyone any ideas? Networking is my weak spot and this is driving me nuts....

I could must use the Pi-hole admin portal on 'pihole-sidecar.mytailnet.com' it works fine, but it annoys me I can't use HTTPS for it.

Does that make sense? I think I've got it right?

Any assistance appreciated.