Validated before deploy
Your indexer and usenet accounts are checked live before anything installs. You see green checks, then it builds — not a broken stack you debug afterward.
Server v0.26.0 on GitHub · iOS app in beta
The only thing you need
to manage your media empire.
Tailarr deploys Sonarr, Radarr, and 40+ self-hosted apps where every service becomes its own device on your private Tailscale network — its own hostname, its own HTTPS certificate, its own access identity. Zero ports opened. Nothing exposed to the internet.
sudo bash -c "$(curl -fsSL https://raw.githubusercontent.com/scs32/tailarr-server/main/install.sh)"
sonarrsonarr.tail1a2b.ts.nethttps
radarrradarr.tail1a2b.ts.nethttps
nzbgetnzbget.tail1a2b.ts.nethttps
overseerroverseerr.tail1a2b.ts.nethttps
notifynotify.tail1a2b.ts.nethttps
Tailarr Server
Tailarr
tailnet
Sonarr
Radarr
NZBGet
Overseerr
Notify
Tautulli
Tailarr for iOS
Running the *Arr stack used to mean becoming a part-time network engineer — port forwards, reverse proxies and auth layers, API keys copied between six web UIs.
Tailarr skips all of it. The tailnet is the stack.
Install
One line. Bulletproof.
Run it, answer two questions, and walk away. The installer checks everything first and only then touches your machine — so it either works, or tells you why in seconds.
- No secrets in your terminal history. It asks for your Tailscale credential when it's ready — you never paste keys into a command.
- It checks before it changes. Your credential, your network, your disk — all verified up front. A typo fails fast on a clean machine, not halfway through an install.
- One thing to set up first: a dedicated (free) Tailscale tailnet — the two-minute guide walks you through it.
Debian / Ubuntu box or VM
sudo bash -c "$(curl -fsSL https://raw.githubusercontent.com/scs32/tailarr-server/main/install.sh)"macOS — Apple silicon, macOS 15+, Tailscale.app 1.86+
bash -c "$(curl -fsSL https://raw.githubusercontent.com/scs32/tailarr-server/main/install-mac.sh)"On a Mac it runs under apple/container and sets up a Tailscale peer relay automatically, so pods run at local speed.
Magic Stacks
One form. A complete working pipeline.
The Usenet Starter stack collects only what Tailarr can't know — your media folder, one indexer, your usenet account — then installs Sonarr, Radarr, and NZBGet and wires every connection between them automatically.
Wired end to end
Download clients, indexers, root folders, notifications — every connection between the apps is configured for you. No copying API keys between web UIs, ever.
More stacks coming
Usenet Starter ships today. Bigger stacks are on the way — same idea: one form, live validation, a pipeline that works on the first try.
People
Hand your family a working app.
People are first-class. Add a person, flip badges for the services they get, and their devices see exactly those services — nothing else, not even the names of what they can't reach.
Default-deny, per person
Tailarr authors the ACLs; Tailscale enforces them. A person's devices can reach the services on their badges and nothing more. No badge, no route, no name.
The app configures itself
Tailarr for iOS asks the server "who am I and what do I get?" — and every connection appears: Sonarr, Radarr, NZBGet, Overseerr, notifications, keys already in place. Zero-config onboarding.
Notifications, badge-scoped
Media events — downloads, upgrades — flow from the Arrs through a private notification service Tailarr runs for you. Auto-wired, per-person, scoped to the badges each person holds.
Real push wakes arrive via a content-free relay: it only ever says "wake up and check your server." Titles, posters, and everything private stay on your box. The ntfy path works today; iOS push is rolling out with the app beta.
Appliance
Run it like an appliance.
A web UI on your tailnet handles the day-to-day, and everything it does on your behalf is a plain script you can read.
40+ app catalog
Click-to-install catalog with live install steppers. Sonarr, Radarr, the Plex-adjacent stack, and dozens more — each lands as its own tailnet device.
Per-pod stats & monitors
Live resource stats and health monitors for every pod, plus a folder browser and NFS share management for your media storage.
Self-upgrade that rolls back
One click upgrades Tailarr itself. It health-checks the new version and automatically rolls back if anything fails. You never nurse an update.
Plain scripts, no black box
Every deployment Tailarr generates is a shell script you can open and read before you trust it. Podman pods, no daemon, no magic state.
macOS, at local speed
One command installs on Apple silicon via apple/container, with an automatic Tailscale peer-relay fix so pod traffic doesn't detour through distant relays.
Yours to tune
Ten UI themes, private registry support for your own images, and an open MIT-licensed codebase when you want to see how any of it works.
Security
Reachability is the
permission model
No ports forwarded. No reverse proxy. No auth layer to misconfigure. If a device can reach a service, it was granted that service — there is no other path.
Nothing to misconfigure
There is no public surface: no forwarded ports to scan, no login page for bots to hammer, no proxy zero-day to lose sleep over. Outside your tailnet, none of it exists.
The controller is invisible
Non-admin devices can't see the Tailarr controller at all — not its name, not its address. The thing that manages your empire isn't on the menu.
Default-deny, as an invariant
A guest device's network map contains only what you granted it — enforced as a code-level invariant in how Tailarr authors ACLs, not a convention you have to maintain.
FAQ
Questions, answered straight
What do I need to start?
A Debian/Ubuntu box or VM (or an Apple-silicon Mac on macOS 15+), and a dedicated free Tailscale tailnet with the starting policy from the README pasted in. The setup guide covers creating the tailnet and the OAuth client — it takes a few minutes, once.
Is piping curl into sudo bash really a good idea?
Read it first — the script is public, and so is everything it generates. It also does nothing to your system until every preflight passes: the credential is validated live against the Tailscale API, your tailnet policy is inspected, disk and connectivity are checked. Bad input fails in seconds on a clean machine. (Automating? TS_API_CLIENT_ID / TS_API_CLIENT_SECRET env vars are supported for non-interactive installs.)
What is a Magic Stack, exactly?
One form that produces a complete working pipeline. The Usenet Starter stack asks for your media folder, one indexer, and your usenet account, validates the accounts live, then installs Sonarr + Radarr + NZBGet and wires every connection between them — download clients, indexers, folders, notifications. It's the only stack today; more are coming.
Do people I add see everything on my server?
No — the opposite. Access is default-deny: a person's devices see exactly the services you badge them for, and nothing else. Services they can't reach don't appear dimmed or locked; they aren't in their network map at all. The controller itself is invisible to non-admin devices.
Do push notifications leak my library to a cloud?
No. Real push wakes go through push.tailarr.com, a content-free relay that only ever says "wake up and check your server." Titles, posters, and everything private stay on your box; your device fetches the details over the tailnet. The ntfy path works today; iOS push is rolling out with the app beta.
Is there an Android app or an App Store release?
Not yet. The iOS app is in beta on TestFlight. But every service the server deploys is also just a URL — sonarr.your-tailnet.ts.net — so any browser on your tailnet works today, on any platform.
How is this different from CasaOS or Umbrel?
Those put a dashboard on your LAN and publish ports. Tailarr publishes nothing anywhere: every service, including its own web UI, exists only as a device on your private tailnet with automatic HTTPS. And it goes past deployment — Magic Stacks wire the apps to each other, and people-level ACLs decide who sees what.
Is it free?
Yes. The server is open source under MIT; the iOS app is free and in beta. There's no pricing page because there's no price. Tailscale's own free tier covers personal use — you, your services, and the people you share with.
Close the ports.
Keep the empire.
One line to install. One form to a working pipeline. One badge to share it.
sudo bash -c "$(curl -fsSL https://raw.githubusercontent.com/scs32/tailarr-server/main/install.sh)"