Remote access
Your photos, away from home.
Filamama stays on your home network. To reach it from a trip or the office, put a private network in front of it. No port to open, nothing to change in Filamama.
Recommended · Tailscale
A private network, just for your devices.
Tailscale links your server and your phones over WireGuard. Only devices signed in to your tailnet can reach Filamama. Nothing is published on the internet.
- Install Tailscale on the server: the Spark or any Linux machine with the one-line script, a Mac mini with the app
- Install the Tailscale app on each phone and laptop, signed in to the same account
- Open https://<host>:5400, with the machine name MagicDNS gives it
- Phones keep backing up straight to the server, with its key pinned
- Optional:
tailscale servefor a trusted https name inside your tailnet
$ curl -fsSL https://tailscale.com/install.sh | sh$ sudo tailscale up$ tailscale status# then, from any of your deviceshttps://spark:5400# optional, trusted HTTPS in the tailnet$ sudo tailscale serve --bg https+insecure://localhost:5400
Alternative · Cloudflare Tunnel
A public link, behind a locked door.
cloudflared opens an outbound tunnel from your server to a hostname on your domain, like photos.example.com. Anyone can type that address, so it must sit behind Cloudflare Access.
- Point the hostname to https://localhost:5400 and turn on No TLS Verify (the certificate is self-signed)
- Required: a Cloudflare Access policy that lets in only your household
- Filamama’s own sign-in still applies behind it
- Traffic transits Cloudflare: TLS ends at its edge
- The free plan’s terms restrict heavy video and large-file serving
$ cloudflared tunnel login$ cloudflared tunnel create filamama$ cloudflared tunnel route dns filamama photos.example.com# service: https://localhost:5400, noTLSVerify# then Zero Trust › Access › add an application$ cloudflared tunnel run filamama
Side by side
Which one?
Tailscale for the family’s own phones and laptops. A tunnel only when you need a link in a browser, with Access in front.
| Question | Tailscale | Cloudflare Tunnel |
|---|---|---|
| Who can reach it | Only devices in your tailnet | Anyone with the link, gated by Cloudflare Access |
| Ports opened on your router | None | None |
| App on each device | Tailscale | A browser is enough |
| Who sees your traffic | Nobody: WireGuard, end to end | Cloudflare: TLS ends at its edge |
| Phone backup | Yes, direct to the server | No |
| Large videos | Fine | Limited by terms and upload size |
| Certificate | Self-signed, or trusted with tailscale serve | Trusted (Cloudflare) |
| Best for | Your household’s own devices | Occasional browser access |
Security notes
Keep the door shut.
- Never forward port 5400 on your router
- Never leave a tunnel hostname without an Access policy
- Don’t use tailscale funnel: it publishes the server on the internet
- Limit your tailnet to the people who should see the library
- Remove a lost phone under Devices, and its node in Tailscale
- AI agent tokens are secrets: keep them read-only, or turn MCP off when you don’t use it
Questions.
Does Filamama have remote access built in?
No. Filamama serves your home network only and makes no outbound connections. To reach it from outside, you put your own private network or tunnel in front of it, as this page explains.
Should I open port 5400 on my router?
No. Both options on this page work without opening any port, and an open port puts your login page on the whole internet.
Can my phone back up over Tailscale?
Yes, by talking to the server directly at https://<host>:5400 with Tailscale on. The phone keeps checking the server’s pinned key. Through a proxy or a Cloudflare Tunnel it would see another certificate, so use those for the web app only.
Why the certificate warning on Tailscale?
The server’s certificate is self-signed and names only its home addresses, on purpose. Accept it once, or use tailscale serve to get a trusted https name inside your tailnet.
Can I stream my videos through Cloudflare?
Lightly. Cloudflare’s terms restrict serving video and lots of large files through its network on the free plan, and uploads are capped per request. For videos and backups, use Tailscale.