How-to: reach your Lydex Stream library from anywhere with Tailscale

Lydex Stream runs on a machine at home. Tailscale puts that machine and your phone on the same private network wherever you are, so Lydex reaches the server with one address, at home or on mobile data, with no port forwarding, no public exposure of your home IP and no TLS certificates to manage. Everything travels inside WireGuard.

What you need

A machine that stays on at home with your music on it: a Linux box or NAS that can run a binary, a Mac or a Windows PC.
A free Tailscale account.
Lydex on your phone, plus the Lydex Stream plug-in from lydexplayer.app/stream.

1. Install Lydex Stream on the server

Download the package for your platform from lydexplayer.app/stream. Linux packages come as .deb, .rpm and .tar.gz for x86_64 and ARM64; there is a universal macOS build and a Windows zip.

Debian / Ubuntu, running as a system service:

sudo apt install ./lydex-stream-server-*-linux-x86_64.deb
sudo systemctl enable --now lydex-stream

Fedora / RHEL is the same with sudo dnf install ./…rpm. The server listens on port 4545 and keeps its index and artwork under /var/lib/lydex-stream.

One thing to know: the system service runs as an isolated user, so it can only read music folders that are world-readable. If your library lives in your home directory, either open the path (chmod o+rx on each directory down to the music) or run the per-user service instead, which reads anything your own account can read:

systemctl --user enable --now lydex-stream
loginctl enable-linger $USER   # keep it running after you log out

Now open http://<server LAN IP>:4545 in a browser. The first-run wizard creates the administrator account (there is no default password), then add your music folders in the console and let the first scan finish.

Before going any further, test on your home Wi-Fi: in Lydex, open Sources, pick Lydex Stream under Streaming, tap Log in and enter http://<server LAN IP>:4545 with the account you just created. If the library shows up, the server side is done.

2. Put the server on your tailnet

On Linux:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Open the link it prints and sign in. On macOS or Windows, install the Tailscale app from tailscale.com and sign in; the rest is identical.

Then:

Run tailscale ip -4 to see the server's tailnet address (a 100.x.y.z IP). It also gets a MagicDNS name such as music.tail1234.ts.net, shown on the Machines page of the Tailscale admin console. Prefer the name; it stays the same forever.
In the admin console, open the server's machine and choose Disable key expiry. Otherwise the server silently drops off the tailnet after the default 180 days and you have to re-authenticate it.
If the server runs a firewall, allow the port on the Tailscale interface, for example sudo ufw allow in on tailscale0 to any port 4545 proto tcp.

Lydex Stream binds to 0.0.0.0:4545 by default, so it already answers on the Tailscale interface. Nothing to change unless you narrowed bind in lydex-stream.toml.

3. Put your phone on the tailnet

Install Tailscale from Google Play, sign in with the same account and switch it on. Android asks once for VPN permission. If you want it to come back after every reboot without a tap, enable Always-on VPN for Tailscale in Android's VPN settings.

4. Point Lydex at the tailnet address

In Lydex, open Sources, pick Lydex Stream under Streaming and tap Log in:

Server address: http://music.tail1234.ts.net:4545 (or http://100.x.y.z:4545). Plain http:// is correct: the whole path is inside the WireGuard tunnel, so there is nothing to encrypt twice.
Username / Password: the account from the wizard, or any user you created in the console.

That is all. The library appears as a source and browses like local music. Lydex keeps a copy of the catalogue on the phone, so a cold start takes about a second even over mobile data, and favourites, ratings and play counts sync through the server. The address works everywhere: at home Tailscale routes it directly over your Wi-Fi, elsewhere over the internet, so there is no home/away switch to flip.

Tips

Direct or relayed? Run tailscale status on either device. "direct" means the two talk peer to peer; "relay" means traffic goes through a Tailscale relay, which works but adds latency. Allowing outbound UDP 41641 on the home router, or enabling UPnP / NAT-PMP, usually turns a relayed connection into a direct one.
Family or friends: share the server machine with another Tailscale user from the admin console (Machines › Share), create them a Lydex Stream account in the web console, and they use the same address after installing Tailscale and Lydex.
HTTPS if you want it: sudo tailscale serve --bg 4545 publishes the server inside your tailnet as https://music.tail1234.ts.net with a certificate issued by Tailscale (enable HTTPS once in the admin console). Then enter that address without the port.
Self-hosted control plane: if you would rather not depend on Tailscale's coordination servers, Headscale is a drop-in replacement; the Tailscale clients are the same.
Battery: the tunnel is idle when nothing is playing; Tailscale costs very little in the background.

If the phone cannot reach the server

Both devices show as connected in Tailscale, and tailscale ping music from the server reaches the phone.
On the server, curl http://127.0.0.1:4545/api/v1/ping answers. If not, check systemctl status lydex-stream (or systemctl --user status lydex-stream).
The firewall allows 4545 on tailscale0.
The address in Lydex includes :4545 (unless you set up Tailscale Serve).

Questions or a setup that behaves differently? Reply below.