Some of what a screen needs to show is not on the public internet: an internal dashboard, an intranet page, a service behind the firewall.
Screenly connects screens to your own Tailscale network so they can reach those the way your own machines do, without exposing anything publicly.
This runs on ScreenlyOS only. Screenly Anywhere screens cannot join a Tailscale network.
Setting it up
Do this in order. Some of it cannot be changed afterwards.
- In your Tailscale ACL policy, add the tag you want the screens to carry. It has to exist before the next step, and it cannot be added to the OAuth client afterwards.
- In the Tailscale admin console, create an OAuth client with the auth key creation scope, which is the only scope it needs, and assign it that tag.
- In your workspace settings, go to Security and find Tailscale on screens. Enter the client ID, the client secret, and the tag, then save.
- Turn Tailscale on for the screens that need it. Each one joins the network on its own.
Checking it worked
Each screen’s detail page shows its Tailscale state under hardware information. Active means it is on the network. Sign in required means the device is waiting for something on the Tailscale side.
The usual cause of the second is device approval: the auth keys Screenly generates are reusable but not pre-authorized, so if your tailnet requires approval, players sit pending until you approve them in the Tailscale console.
What it does not do
It does not give anyone a route into your screens. The screen reaches out to your network; nothing reaches in.
It also applies per screen rather than per device certificate, so if you need particular screens on particular networks, that is separate tailnets rather than separate keys within one.