# Docker Port Binding and Tailscale Reachability

When Docker containers bind to `127.0.0.1` (loopback), they are only reachable from the host machine. Tailscale traffic arrives on the `tailscale0` interface and cannot reach `127.0.0.1`-bound ports.

## Detection

From the VPS via Tailscale:

```bash
# Port returns 000 (connection refused) — likely 127.0.0.1 binding
curl -s -o /dev/null -w '%{http_code}' --connect-timeout 2 http://100.93.253.36:9925/
# 000
```

On the home server, verify the binding:

```bash
docker inspect <container> --format '{{json .HostConfig.PortBindings}}' | python3 -m json.tool
# {"9000/tcp": [{"HostIp": "127.0.0.1", "HostPort": "9925"}]}
```

## Solutions

### Option A: Proxy through home nginx (preferred)

The home server's nginx already has SSL configs for these services on ports 3443-3450. From the VPS, proxy to the home nginx SSL endpoint with SNI:

```nginx
proxy_pass https://100.93.253.36:3449;   # Mealie via home nginx
proxy_ssl_verify off;
proxy_ssl_server_name on;
proxy_ssl_name grajmedia.duckdns.org;
proxy_set_header Host grajmedia.duckdns.org;
```

This works because the home nginx listens on `0.0.0.0:3449` and proxies to `127.0.0.1:9925` locally.

### Option B: Rebind container to 0.0.0.0

Stop the container, recreate with `0.0.0.0` binding:

```bash
docker stop mealie
docker rm mealie
docker run -d --name mealie \
  -p 0.0.0.0:9925:9000 \
  ... (rest of original options)
```

**Downside**: the service becomes accessible on the LAN without SSL. Only do this for services that don't need the home nginx SSL layer.

### Option C: SSH tunnel

As a last resort, create an SSH tunnel from VPS to home server:

```bash
ssh -L 9925:127.0.0.1:9925 -N -f 100.93.253.36
```

Then nginx on the VPS proxies to `http://127.0.0.1:9925`.

**Downside**: fragile, needs SSH keepalive, adds latency, requires SSH key setup.

## Services by binding type (rayserver)

| Service | Docker port | Binding | VPS approach |
|---------|------------|---------|-------------|
| Immich | 2283 | 0.0.0.0 | Direct HTTP |
| Paperless | 8010 | 0.0.0.0 | Direct HTTP |
| Home Assistant | 8123 | 0.0.0.0 (host net) | Direct HTTP |
| Mealie | 9925 | 127.0.0.1 | Home nginx HTTPS proxy |
| Audiobookshelf | 13378 | 0.0.0.0 | Direct HTTP |
| PocketBase | 8091 | 127.0.0.1 | Home nginx HTTPS proxy |