Access Komga or Kavita outside your home network

The free and simple way to reach Komga or Kavita from outside your home is Tailscale Funnel. It gives your server a public https address, like https://my-nas.tail1234.ts.net, with a valid certificate. You don't need a domain name, and nothing on your router changes. The same steps work for calibre and calibre-web.

How do I set up Tailscale Funnel?

Do this on the computer or NAS that runs Komga or Kavita. If your server runs in Docker, do it on that machine, not inside the container.

Make a free Tailscale account at tailscale.com.
Pick your server and your machine below, then run the lines one at a time in a terminal on that machine. When a line shows a link to sign in, open it and sign in with your Tailscale account.
Linux or Docker. On a Linux computer or server, including one that runs Docker, in a terminal or over SSH:
```
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
sudo tailscale funnel --bg 25600
```
Windows. Install Tailscale from tailscale.com/download and log in from its icon next to the clock. Then, in Command Prompt:
```
tailscale funnel --bg 25600
```
Mac. With Homebrew from brew.sh installed, in Terminal:
```
brew install --formula tailscale
sudo brew services start tailscale
sudo tailscale up
sudo tailscale funnel --bg 25600
```
These lines are for Komga on port 25600. For Kavita use 5000, for calibre-web 8083 and for calibre 8080 instead.
Changed your port? It is the number after the colon in the address you open your server at home, so http://192.168.1.20:25600 means 25600. In Docker, it is the left number in a ports line like 25600:25600.
The first time, the funnel line shows a link to turn on Funnel. Open it and turn Funnel on, and the command finishes by itself. If you closed it, run the line again.
Copy the address it shows under Available on the internet. It looks like https://my-nas.tail1234.ts.net. A new address can take up to 10 minutes to work everywhere.

The --bg part keeps Funnel running after you close the terminal and after a restart. To turn it off, run tailscale funnel reset, with sudo in front on Linux or a Mac.

What about a Synology or Unraid NAS?

On a Synology, install Tailscale from Package Center, then sign in to the NAS over SSH and run the funnel line with sudo in front. On Unraid, install the Tailscale plugin from Community Apps, edit your Komga or Kavita container, turn on Use Tailscale and choose Funnel.

How do I check that it works?

On your phone, turn Wi-Fi off and open the new address. If your Komga or Kavita sign-in page loads, the internet can reach your server, and so can LiveComics. If it doesn't load yet, wait a few minutes and try again.

How do I connect it to LiveComics?

In LiveComics, open your library, tap From a link next to Add, then choose Your library server.
Choose Komga and enter your new address with a Komga API key, or choose Kavita and paste its OPDS URL.
Press Connect, tick the issues you want and press Add.

If Kavita's OPDS URL starts with a home address, keep the part from /api/opds/ on and put your new address in front of it. The guides below have the sign-in steps for each server.

Komga app · Kavita app · OPDS comic reader · calibre comic reader

Is it safe to put my server on the internet?

Funnel makes the address public, so your server's own login is the front door. Keep Komga's or Kavita's login turned on and use a strong password. Connect LiveComics with a Komga API key or a user that isn't an admin. Kavita's OPDS URL works like a password, so don't share it. Funnel encrypts the connection all the way to your machine.

What are the other ways?

A Cloudflare Tunnel, if you own a domain

If your domain already uses Cloudflare, a named Cloudflare Tunnel gives your server an address on it, like https://comics.example.com, and no router ports are opened. In the Cloudflare dashboard, create a tunnel, run the install command it shows on your server, then add a published application that points a subdomain at http://localhost:25600 for Komga or http://localhost:5000 for Kavita. Skip quick tunnels: their trycloudflare.com address changes every time they restart.

A reverse proxy, if you already run one

Give Komga or Kavita its own name, like comics.example.com, with a free Let's Encrypt certificate, and forward port 443 on your router to the proxy. Use the standard https port, 443.

Straight answers

Is Tailscale Funnel free?

Yes. Tailscale says Funnel is available on all of its plans, including the free one, and the ts.net address comes with it. You don't need to buy a domain.

Do I need to open ports on my router?

No. Tailscale Funnel and a Cloudflare Tunnel both connect out from your server, so nothing on your router changes. Only a reverse proxy needs a port forwarded.

Why doesn't my normal Tailscale address work?

Only your own devices can reach it. A 100.x.x.x address, or a ts.net name without Funnel, is private to your tailnet, and LiveComics fetches from its own servers. Turn on Funnel and use the address it shows.

Will my Funnel address change?

No. It stays the same while the machine keeps its name in Tailscale. A Cloudflare quick tunnel is the one that changes: its trycloudflare.com address is new every time it restarts.

Is Funnel fast enough for big comics?

It can be slow for very big files. Tailscale limits Funnel's bandwidth and doesn't publish the numbers. In our own test, a 14 MB comic took 13 seconds, so a large file takes much longer to import. If you import a lot of big files, a Cloudflare Tunnel or a reverse proxy avoids that limit.

Does this work for calibre-web and calibre?

Yes. Use port 8083 for calibre-web or 8080 for calibre's content server in step 2, then choose calibre-web or calibre in LiveComics. calibre's content server must use basic sign-in.

How do I turn Funnel off?

Run tailscale funnel reset on that machine, with sudo in front on Linux or a Mac. The address stops answering from the internet, and your server keeps working at home.

Create your free account →