Tailscale is an awesome, very simple to use VPN system that allows you to set up your own secure virtual private network (they call this a ’tailnet’), and then access resources on that network from anywhere on the internet → privately and securely, and without opening any ports up on your router. (Tailscale uses the modern and efficient WireGuard VPN system, but dresses it up to make it easier to use, with no manual fussing with keys etc). In a nutshell, you install Tailscale on your media server at home, and then use it to access you local network as if you were there.
Jellyfin is a popular open source media server, which you can use to offer your Movies, TV Shows, PVR, Music, and pictures to Kodi. It’s an easier way of setting up Kodi for shared library access vs. the older approach of MySQL, providing a centralised place to manage your media and artwork etc., which is then offered up to clients. Those clients can be yourself, or you can share with friends and family if you wish.
This guide assumes you already have Jellyfin running on a server on your network, and you have installed Tailscale on that machine, and now you want to share Jellyfin to your CoreELEC Kodi client. Once set up, you can use that Kodi client at home, but also - safely and securely - anywhere else you have internet access. For example, you want to take your tablet or a mini Kodi player on holiday with you, and still have access to your home media library, just as if you were at home, with the full Kodi experience at hand.
To access your tailent, we’ll need Tailscale on the Kodi box. The easiest method is to first need to install the Entware package manager, and then install the Tailscale package from there.
First, connect to your CoreELEC box via SSH.
Run the handy shortcut to install Entware: installentware
Reboot your CoreELEC box.
Update the package list and install Tailscale with: opkg update && opkg install tailscale
To join this machine to you tailnet: tailscale up → you will be shown a URL you then visit to authorise this machine in the Tailscale WebUI (and you probably want to disable key expiry for this machine while you’re there).
If you want Tailscale to run at all times and start automatically at boot up, you need create or add to your /storage/config/autostart.sh file:
#!/bin/sh
# Autostart Tailscale
/opt/etc/init.d/S06tailscaled start
Note that if you have any subnet routers on your network, and enable using these on your CE box, e.g. via tailscale up --accept-routes, you will immediately lose the ability to access your CoreELEC box via the local IP address, and therefore must use the Tailscale IP for all access (e.g. perhaps you’re using Kore or Yatse for remote control). (This is not the typical behaviour on Linux systems, so can initially be confusing if you’re used to using Tailscale with regular Linux distros like Ubuntu).
Per the notes below, you should use the Tailscale IP for Jellyfin access, so you probably don’t actually need to accept routes on this machine anyway, and I recommend leaving accept routes off.
Note also that Tailscale’s Magic DNS does not work with CoreELEC, due to the read only file-system. So, again, you will need to use Tailscale IP addresses to reach other systems on your tailnet from the CoreELEC box. (If you run tailscale status you will see):