Skip to content

Remote access

Your people need to reach the server from their homes. Pick one of these. All of them keep your media on your hardware; they only change how the connection gets in.

First: can you port forward?

Look up your router's WAN (internet) IP in its admin page and compare it with what a site like whatismyip.com shows. If they differ, your provider uses CGNAT (one public IP shared between many customers) and port forwarding won't work. Skip to a tunnel.

Option A: port forwarding with HTTPS

The classic setup, and the fastest for downloads.

  1. Give the server a fixed IP on your network (a DHCP reservation in your router).
  2. Pick a random high port between 20000 and 60000, like 41873. It keeps casual scanners away from ports 80 and 443.
  3. In your router, forward TCP 41873 to the server's IP, same port.
  4. Put a reverse proxy in front for HTTPS. Caddy with a DNS plugin can get a certificate through your DNS provider's API (DNS-01), so ports 80/443 can stay closed:
Caddyfile
movies.example.com:41873 {
tls {
  dns cloudflare {env.DNS_API_TOKEN}
}
reverse_proxy moovo:8080
}
  1. Point movies.example.com at your home IP. If your IP changes, run a dynamic-DNS updater (many routers have one built in).
  2. Set MOOVO_PUBLIC_URL to https://movies.example.com:41873 and restart.

Option B: Cloudflare Tunnel

No open ports at all, and it works behind CGNAT. Great for browsing and downloads of normal-sized files.

  1. In the Cloudflare dashboard: Zero Trust → Networks → Tunnels → Create a tunnel, and copy its token.
  2. Add the connector next to the server:
docker-compose.yml (excerpt)
tunnel:
  image: cloudflare/cloudflared:latest
  restart: unless-stopped
  command: tunnel run
  environment:
    TUNNEL_TOKEN: ${CLOUDFLARE_TUNNEL_TOKEN}
  1. Add a public hostname (e.g. movies.example.com) pointing to http://moovo:8080.
  2. Set MOOVO_PUBLIC_URL to https://movies.example.com.

Option C: Tailscale

Everyone who installs Tailscale and joins your tailnet can reach the server privately, with nothing exposed to the internet. It's the most private option and works behind CGNAT; the trade-off is that each person installs one extra app. Tailscale Funnel can publish it to the internet instead, if you prefer.

Security checklist

  • Keep the media mounts read-only (:ro).
  • Use HTTPS for anything reachable from the internet.
  • Only people you invite can sign in; invites can be revoked at any time.
  • Keep the server updated (Updates & backups).