Glider
Install Glider
Browse documentation

Keep · private remote access

Use your domain with Keep

Use an address such as https://keep.example.com/mcp from computers connected to your Tailscale network.

This setup uses Cloudflare DNS and Caddy for HTTPS. The domain stays the same when you move the service.

Start with the files and token from the installation guide. Run all commands below from the downloaded docker directory.

Configure private access

Prepare the accounts and domain

Use a domain with DNS managed by Cloudflare and a Tailscale account.

  • Each client computer must connect to your Tailscale network. Permit access to the Keep node on TCP port 443 in your access rules.
  • The supplied remote Compose file uses a separate project and data volume. Stop the local service before you transfer its store.
  • Follow the store transfer instructions if you already have documents.
  • This setup publishes no host ports. Tailscale forwards private TCP traffic to Caddy, which terminates HTTPS and forwards requests to Keep.

Set the domain and certificate contact

Create a .env file in the docker/remote directory with your own domain and email address.

  • Use the bare hostname for KEEP_DOMAIN, without a scheme, port, or path.
  • Keep uses this domain as its allowed public HTTP authority. Caddy preserves that authority and the client’s Bearer header.
KEEP_DOMAIN=keep.example.com
[email protected]
TS_HOSTNAME=keep

Give Caddy access to certificate validation

Create a Cloudflare API token for the domain’s DNS zone.

  • Grant Zone:DNS:Edit and Zone:Zone:Read for that zone only.
  • Save the token as one line in secrets/cloudflare_api_token. Use your editor without placing the token in chat or command history.
  • Keep the secrets directory private. The Caddy container must be able to read the token file.
  • Caddy uses DNS validation to obtain and renew a certificate. It needs no public inbound port for this validation.
  • See the Caddy Cloudflare module for token permissions.

Connect the service to Tailscale

Start the Tailscale container and complete its account login.

  • Open the login link from the second command in your browser and approve the node in your account.
  • The named Tailscale volume retains the node identity. Keep it when you replace containers.
  • The last command prints the node’s Tailscale IPv4 address for the next step.
docker compose -f remote/compose.yaml up -d tailscale
docker compose -f remote/compose.yaml exec tailscale tailscale up
docker compose -f remote/compose.yaml exec tailscale tailscale ip -4

Point your domain to the private node

Create an A record in Cloudflare for your selected hostname.

  • For keep.example.com, set the record name to keep and its address to the Tailscale IPv4 address.
  • Select DNS only. Cloudflare’s proxy cannot reach this private Tailscale address.
  • DNS can resolve publicly, but the service requires Tailscale connectivity. This setup enables no Tailscale Funnel.
  • If your resolver blocks private-address answers, configure an exception for this hostname in that resolver.

Start HTTPS and connect

Build the supplied Caddy image and start the remote services.

  • Wait for Keep to become healthy and for Caddy to obtain the certificate. Inspect the service logs if startup fails.
  • Use https://keep.example.com/mcp in your MCP client, with your actual hostname and the existing Keep Bearer token.
  • Ask the agent to list existing spaces and collections without changing documents.
  • Use docker compose -f remote/compose.yaml for later commands against this deployment.
docker compose -f remote/compose.yaml up -d --build
docker compose -f remote/compose.yaml ps
docker compose -f remote/compose.yaml logs caddy

Move to another server

Transfer a stopped store and preserve the client address.

  • Use the backup procedure with the remote Compose file, then restore into an empty destination volume.
  • Transfer the configuration and secrets securely. Connect the new node to Tailscale and update the DNS record to its address.
  • Keep the same domain and Keep token so client settings remain valid. Stop the old service before the final transfer.
  • Do not start two Tailscale containers with copies of the same node identity.

Access and maintenance

  • Tailscale restricts network access; the Keep token still grants full access to the shared store.
  • Preserve the Caddy data volume for certificates and the Tailscale state volume for node identity.
  • The Keep backup contains neither of those volumes. Preserve secrets and configuration separately.
  • See Tailscale Docker and Tailscale Serve for network configuration.