I ditched my reverse proxy nightmare and let Tailscale handle Vaultwarden's HTTPS instead

Published Aug 30, 2026, 1:00 PM EDT Abhishek is an author at XDA who covers computing. He has loved computers since he got the Lenovo G570 in 2012. Abhishek holds a master's degree in computer applications and began his writing career in 2018. He loves writing how-to articles, listicles, and informational posts on popular operating systems and web services. He closely follows the Windows Insider program and tests new Insider builds to discover upcoming experimental features and upgrades. His past work includes long-term collaborations with reputed publications like Tom's Hardware, and Windows Latest. When not writing anything, he is busy watching new episodes of One Piece or searching for something binge-worthy. Networking is the most complicated aspect of self-hosting, in my opinion, and I try to stay away from anything that's not basic stuff. I remember my starting days with a Raspberry Pi, when even SSH seemed like trouble, but I slowly crossed that mountain and soon became proficient with port assignments and remote access. However, locally hosting a tool is just the first part of building a true remotely accessible home lab. Locally hosted tools pose no problem because they work only on your local network. The problem arises when some tools require HTTPS and refuse to launch over an insecure connection. Vaultwarden made me rethink my strategy and enable HTTPS, which I had been fending off for too long. Vaultwarden worked for a year on DietPi Switching to Docker posed a problem I've used Vaultwarden as my only tool on a Raspberry Pi Zero 2 W for more than a year. I ditched LastPass last year, and since then, Vaultwarden has stored my passwords and served as my local password manager. I use the Bitwarden desktop extension to sign in to frequently used websites. For remote access, I use Tailscale on the SBC and can then access the tool's web portal when I'm away. This setup worked fine until a couple of weeks back, when I tried to migrate Vaultwarden to a Docker setup. Vaultwarden is one of the few tools that needs an HTTPS connection to work. Without it, you can't get past the first page of the web portal after you install the tool. I remember trying to run it as a Docker container, struggling with HTTPS, and then switching to DietPi’s software repository as an alternative. But how could Vaultwarden work? I don't have the exact answer, but it seems that DietPi's software repository installs a copy of Vaultwarden that creates a self-signed TLS certificate. It helped me avoid configuring HTTPS. But Docker isn’t as simple as DietPi, and I wondered what I could do to fix it and get the container working. Reverse proxies aren't my cup of tea Tailscale and Magic DNS resolved the issue I've always had trouble setting up reverse proxies with Caddy and Nginx. They don't work and fail to assign a secure IP address and serve the tool over HTTPS. Many self-hosted users like reverse proxies, but I detest them because they're so complex. I never really experimented with HTTPS and Magic DNS in Tailscale and only used it as a secure route to access my servers and tools remotely. But when the reverse proxy attempt failed this time, I researched methods to accomplish HTTPS via Tailscale. Instead of running multiple terminal commands to generate security certificates, the process was surprisingly simple. To enable HTTPS, I just needed to add my device to the Tailscale network, go to settings, and enable Magic DNS and HTTPS; it then generated Let's Encrypt certificates. The last step was to serve Vaultwarden on a specific port over HTTPS, which I did with the following command: tailscale serve --https 443 http://localhost:8081 After running the command, the Vaultwarden portal stopped throwing the error when I accessed it via the secure URL. I completed the setup, imported my data into Vaultwarden, and did a quick Pi reboot. But the portal threw an error, which made me doubt whether it was a fluke. Configuring Tailscale to permanently serve over HTTPS Enabling app access The command that I used to serve Tailscale over HTTPS wasn’t a persistent one and only worked in the foreground. So, I had to execute it every time I rebooted the server. I modified the command to make serve run permanently in the background with the –bg flag: tailscale serve --bg --https 443 http://localhost:8081 That fixed one more problem I had with Vaultwarden. While the remote access let me view the portal and find the passwords for saved websites, the app didn’t work. It would fail to connect to the DietPi server and throw a certificate error, citing an insecure connection. Without the app, the auto-sign-in experience on the phone wasn’t as fluid as a paid tool. But I rarely signed in to new apps and learned not to nitpick. But after using Tailscale to handle security certificates, the app didn’t throw an error when I tried connecting to the Vaultwarden server. I had to add the phone to the Tailscale account, and then the sign-in worked on the first attempt. I could now easily sign in to websites on the phone, in any browser. Since Chrome lacks extension support, the app makes it easy to access the vault, generate passwords, and do more without navigating the web portal. It also gave me confidence to serve any other tool over HTTPS if it became mandatory tomorrow. The only caveat with Tailscale setup is that your machine name and Tailnet DNS name are published in the public Certificate Transparency ledger. Anyone can view it, which can be a turnoff for true self-hosting enthusiasts. I run three Docker containers on a Raspberry Pi Zero 2 W, which has been hosting Vaultwarden for a year. Tailscale makes HTTPS simple for networking beginners, and you can use its web portal to manage most settings. The only hurdle is signing all your devices to the same tailnet and making the server action run permanently in the background. All three containers (Vaultwarden, BentoPDF, and OmniTools) work in complete harmony, and it's a better utilization of the SBC’s computing resources. Securing Vaultwarden Avoid reverse proxies using Nginx because Tailscale can do it in under five steps with minimal terminal interaction. I had tried implementing Caddy and Nginx before, but getting them to work with Docker isn’t everyone’s cup of tea. Tailscale solves remote access and secure routing, while others only provide secure access. It’s one of the main reasons I added all my home servers to the tailnet, because there’s no better alternative for my needs. Tailscale Tailscale is a tool that allows you to create specific network connections so you can remotely access resources within a private network.