● Private storage / 003
Camera to NAS with Tailscale or Headscale: where the tunnel belongs
A secure reference architecture for routing camera uploads to a private NAS without expecting a camera to run Tailscale or exposing NAS storage ports.
- Published
- Reading time
- 9 minutes
- Source policy
- Primary / official
The practical answer
The camera should send to a public, camera-compatible ingest endpoint. A paired delivery agent on the NAS—or a cloud delivery worker joined to the same private network—then moves the verified asset across Tailscale or a Headscale-coordinated tailnet. The tunnel belongs between capable computers, not inside the camera.1,2,4
In this workflow, the camera stays an FTP client—not a mesh-VPN node.
Tailscale assigns addresses and connectivity to devices running its client. Its documentation also describes subnet routers for devices that cannot run the client—including cameras—but a subnet router makes a service reachable; it does not create an FTP server or teach the camera a new protocol.1,2
For remote delivery, keep the camera flow ordinary: camera to public ingest over a supported FTP-family protocol. After the file is complete and verified, place a delivery-capable machine on the private network and let it address the NAS service.
Choose by ownership and operational appetite.
All three patterns can preserve a private NAS. They differ in who initiates transfer and who operates network coordination.
Outbound NAS agent
The agent pairs with the account, requests only its queued assets, writes to an approved local root, verifies placement, and acknowledges completion. No inbound NAS route is required.
Tailscale-connected delivery worker
Install Tailscale on a supported NAS or nearby relay and on the delivery worker. Apply a policy that permits only the worker to reach the required service and port.1,3
Subnet router beside the NAS
When the NAS cannot run the client, a subnet router can advertise the NAS subnet to the tailnet. Tailscale documents this pattern specifically for devices that cannot run the client.2
Tailscale and Headscale solve coordination—not camera ingest.
Tailscale is the managed path. Headscale describes itself as an open-source, self-hosted implementation of the Tailscale control server with a narrow focus on a single tailnet for personal use or a small open-source organization. Headscale still requires Tailscale clients to register nodes.4,5
That makes Headscale an infrastructure-ownership decision, not an ingest shortcut. A production operator must own its public control-server availability, upgrades, backups, policy, identity setup, and troubleshooting. The Headscale project explicitly frames its focus around self-hosters and says performance is not its development focus for commercial-scale deployments.6
| Choice | You operate | Best fit for an early beta | Camera setup changes? |
|---|---|---|---|
| Outbound agent only | Agent lifecycle and authenticated queue | Simplest customer-owned NAS path | No |
| Managed Tailscale | Clients, policy, and device authorization | When direct private addressing helps operations | No |
| Self-hosted Headscale | Control server plus clients, policy, identity, upgrades, and recovery | Labs or teams that explicitly need control-plane ownership | No |
The agent needs a smaller permission set than the NAS owner.
A safe agent should receive an opaque delivery job, not arbitrary shell commands or an unrestricted filesystem path.
Pairing
Use a short-lived pairing code to mint a revocable agent identity bound to one account.
Filesystem boundary
Configure one local destination root. Resolve and reject any job path that escapes it.
Transfer
Stream to a temporary filename, enforce size limits, calculate the expected checksum, then rename atomically.
Recovery
Persist the job cursor and retry with backoff after power, internet, or NAS interruption.
Observability
Report queued, transferring, verified, delivered, and failed states without exposing private addresses or local paths to other tenants.
Frequently asked questions
01Can a mirrorless camera connect directly to Tailscale?+
Not unless the camera can run a supported Tailscale client, which typical camera firmware cannot. Tailscale documents subnet routers as the bridge for devices that cannot run the client, but Camera to Anywhere keeps the camera on its documented FTP-family path.2
02Does Tailscale provide the SFTP, SMB, or WebDAV service?+
No. Tailscale provides network connectivity. Its documentation states that a specific destination service—such as SSH or a web server—must still be running on the target device.1
03Should Camera to Anywhere use Headscale instead of Tailscale?+
Not for the first NAS beta by default. An outbound agent avoids requiring either control plane. Managed Tailscale is the lower-operations option when private addressing is useful; Headscale makes sense only when self-hosting the coordination layer is an explicit requirement.4,6
04Does a private NAS need an open inbound port?+
No. An outbound agent can poll or hold an authenticated outbound connection, download its assigned object, verify it, and acknowledge placement. A mesh-VPN design can also avoid public port forwarding by keeping the service reachable only inside the private network.
Official sources
Sources were reviewed on August 26, 2026. Vendor interfaces and documentation can change; follow the linked source and re-test the exact production workflow.
- 01TailscaleConnect to devices ↗
- 02TailscaleSubnet routers ↗
- 03TailscaleTailnet policy syntax ↗
- 04HeadscaleHeadscale project documentation ↗
- 05
- 06HeadscaleHeadscale FAQ ↗