Reaching Kustos from outside the house
Kustos is an admin application. There is one operator, and housemates never sign into it.
Most of what they do does not touch Kustos at all. Linking their Trakt or Plex account happens on Plex's and Trakt's own sites, and Kustos hears the outcome by polling outbound — so that works from anywhere without Kustos being reachable. The only thing that touches Kustos is the Invite page, which lives on the link paths (/link/*, /api/v1/public/*). Those paths are token-gated, not public: there is no address on the internet for any of this, and there should not be.
Kustos listens on every interface on port 8787 and does not publish itself. Nothing it does opens a port on your router, and nothing should: the admin portal is the whole application, so putting it on the public internet means anybody who finds it is one password away from your library.
Use a private network. That is the answer. Tailscale, WireGuard or any VPN puts your phone and laptop on the same network as the server. Nothing is exposed publicly, there is no address for a stranger to find, and you sign in exactly as you do at home.
With Tailscale: install it on the server and on the device you want to use, then open http://<machine>.<your-tailnet>.ts.net:8787, or the machine's 100.x.y.z address. No certificate, no domain, no port forwarding, nothing to renew.
The one thing that catches people out: Windows Firewall. Kustos answers on the VPN interface, but Windows blocks inbound connections from other machines unless a rule allows them — so it works from the server itself and times out from your phone. Allow the port for the VPN range only, never for everything: ``powershell New-NetFirewallRule -DisplayName "Kustos (Tailscale only)" -Direction Inbound -Protocol TCP -LocalPort 8787 -RemoteAddress 100.64.0.0/10 -Action Allow `` That range is Tailscale's. It permits your own devices and nothing else, which is the difference between "reachable from my phone" and "reachable".
Link and Invite: two buttons, and one of them works from anywhere
Each person's card in Connections carries Link and Invite side by side. They look interchangeable and are not. The difference is who serves the page they land on, and that decides whether they have to be in your house.
| Who hosts the page | Works from | Use it when | |
|---|---|---|---|
| Link | Plex or Trakt, on their own site | Anywhere. Nothing published, nothing installed. | Almost always. |
| Invite | Kustos | Only where Kustos is reachable — your network, or your VPN. | You specifically want the Kustos invite page. |
Link is the one to reach for, including for somebody who is not in your Plex Home and not in your house.
It works because the page was never yours to serve. Kustos asks Plex or Trakt for a code and gets back a link with that code already in it — app.plex.tv/auth for a Plex account, trakt.tv/activate/<code> for Trakt. You send that link however you like. They click it, sign in as themselves, approve, and Kustos learns the outcome by polling outbound. Nothing of yours is exposed, and they never create an account they did not already have.
The code is carried through sign-in, so somebody not already signed in lands on the approval screen with it filled in rather than on a page asking for eight characters.
The deadlines differ, and a stale link fails quietly. A Plex link is a four-hour code. A Trakt one is shorter still. The Kustos invite token lasts seven days.
Invite is the Kustos-hosted path, and it is the one with a reachability problem. The page lives at your Kustos, so whoever opens it has to be able to reach your Kustos. In practice that means your home WiFi, once, for a few minutes.
If you use it, set Settings → General → External URL to the server's address on your own network — http://192.168.1.10:8787, with your machine's actual address. Invite links are built on whatever is in that box, so:
- localhost produces a link that only works on the server itself, which is the usual reason an invite "does not open" for somebody.
- A LAN address produces a link that works for anyone on your WiFi.
Kustos tests the address when you create an invite, so a link nobody else can open is caught at the point you make it rather than after you have sent it.
If somebody cannot be on your network, use Link rather than the VPN. That is the whole reason Link exists. Putting a relative in another house onto your VPN to accept an invite is work you do not have to do.
We still do not recommend publishing Kustos. Not the app, and not the link paths on their own through a tunnel or a reverse proxy. It is real work to get right and one misconfiguration away from putting the admin portal on the internet — and with Link there is nothing left that publishing would buy you.