Reaching your private network

Put your screens on your own Tailscale network so they can show internal dashboards and intranet pages, configured once for the fleet.

Some of what a screen needs to show is not on the public internet: an internal dashboard, an intranet page, a service behind the firewall.

Screenly connects screens to your own Tailscale network so they can reach those the way your own machines do, without exposing anything publicly.

[!NOTE] This runs on ScreenlyOS only. Screenly Anywhere screens cannot join a Tailscale network.

Setting it up

Do this in order. Some of it cannot be changed afterwards.

1. In your Tailscale ACL policy, add the tag you want the screens to carry. It has to exist before the next step, and it cannot be added to the OAuth client afterwards.
2. In the Tailscale admin console, create an OAuth client with the auth key creation scope, which is the only scope it needs, and assign it that tag.
3. In Screenly, go to Settings > Integrations > Tailscale. Enter the client ID, the client secret, and the tag, and connect.
4. Go to Settings > Security > Tailscale, and next to Tailscale on screens choose Enable. Every screen in the workspace joins your tailnet on its own, with no key to type in and nothing to set up on the player.

When you replace the key, players pick up the new one and reconnect on their own.

Checking it worked

Each screen's detail page shows its Tailscale state under hardware information. Active means it is on the network. Sign in required means the device is waiting for something on the Tailscale side.

The usual cause of the second is device approval: the auth keys Screenly generates are reusable but not pre-authorized, so if your tailnet requires approval, players sit pending until you approve them in the Tailscale console.

What it does not do

It does not give anyone a route into your screens. The screen reaches out to your network; nothing reaches in.

It carries web resources only: internal web pages and APIs. Videos, images, and other files still reach screens through Screenly, and so does managing the players.

It also applies per screen rather than per device certificate, so if you need particular screens on particular networks, that is separate tailnets rather than separate keys within one.