Setup guide

Domain, DNS & Remote Access

Players find the server by name, so the name must resolve and be reachable from wherever the players are. There are five ways to make that happen; most properties need one, large ones combine two.

The options

Option What you need Open ports Cost Strength Watch out for
1. Static IP + A record Static public IP from the ISP; access to your DNS TCP 443, TCP 80 ISP’s static-IP fee Simplest, fastest, no third party in the path You run the firewall and keep the server patched
2. Dynamic DNS A DNS provider with an API (e.g. Cloudflare) or a DDNS service TCP 443, TCP 80 Usually free Works on ordinary business internet with a changing IP Up to a few minutes’ outage each time the IP changes
3. Cloudflare Tunnel Free Cloudflare account; your domain’s DNS moved to Cloudflare None Free No public IP, no port forward; works behind CGNAT and Starlink Off-site video passes through Cloudflare; read their terms if you stream heavy video to many off-site screens
4. WireGuard VPN WireGuard on the server; each off-site player or site router joins UDP 51820 (none with Tailscale) Free Server never visible on the internet; strongest isolation One more thing to configure per site or per player
5. Internal only Routed networks or a signage VLAN; internal DNS None Free Nothing exposed at all Only works where you control every network the screens sit on

Which one?

  • All screens on networks you control (one building, or your own fiber/wireless plant) → 5.
  • Some screens on networks you don’t control, and the ISP gives a static IP → 1.
  • No static IP → 2, or 3 if you don’t want an open port.
  • Behind CGNAT (Starlink, many cellular and some cable lines, where you can’t port forward at all) → 3.
  • Security comes first and the IT team is comfortable with VPNs → 4.

Whatever you choose, keep split DNS inside the property so on-site players resolve the name to the server’s private IP and never leave the building.

Where your domain’s DNS lives

You add the record wherever the domain’s nameservers point, which isn’t always the registrar. Look it up: nslookup -type=NS yourdomain.com.

NS records point to Where to add signage
Your registrar (GoDaddy, Namecheap, Squarespace Domains…) The registrar’s DNS or “Manage DNS” page
Cloudflare Cloudflare dashboard → DNS → Records
Your web host (cPanel, Plesk) The host’s Zone Editor
AWS Route 53 Route 53 → Hosted zones → your domain
Microsoft 365 or Google Workspace Their admin DNS page, if they manage it

Adding a subdomain record doesn’t touch the website or email. www, @ and MX records stay as they are.

Option 1 in detail: static IP + A record

Add A signage <public IP> TTL 300. On the edge firewall, 1:1 NAT or port forward TCP 443 and 80 to the server. The installer requests the Let’s Encrypt certificate over port 80 and renews it automatically.

Option 2 in detail: dynamic DNS

Best form: keep DNS at a provider with an API and let the server update the record itself. With Cloudflare DNS:

  1. In Cloudflare, create an API token limited to Zone → DNS → Edit for this one domain.
  2. On the server: sudo apt install ddclient, then set protocol cloudflare, your zone, the token, and hostname signage.yourdomain.com.
  3. ddclient checks the public IP every 5 minutes and updates the A record when it changes.

Alternative: point a CNAME (signage → yourname.duckdns.org) at a free DDNS name and run that service’s updater on the server.

Option 3 in detail: Cloudflare Tunnel

The server opens an outbound connection to Cloudflare; Cloudflare answers for signage.yourdomain.com and passes requests down that connection. The router sees no inbound traffic.

  1. Move the domain’s nameservers to Cloudflare (free plan). Recreate existing website and email records first; Cloudflare imports most automatically, but check.
  2. In Cloudflare Zero Trust → Networks → Tunnels, create a tunnel and copy its token.
  3. On the server, install cloudflared from Cloudflare’s apt repository and run sudo cloudflared service install <token>.
  4. In the tunnel, add a public hostname: signage.yourdomain.com → https://localhost:443.
  5. Keep split DNS on site so local players skip the tunnel and stream at LAN speed.

Option 4 in detail: WireGuard

The server runs WireGuard on UDP 51820 with its own private range, e.g. 10.99.0.0/24. For a whole remote site, put WireGuard on that site’s router (most business routers support it) so every player there routes to the server automatically. For a lone screen, install WireGuard on the player itself. Players then use https://signage.yourdomain.com resolving to the server’s VPN address via split DNS. Tailscale does the same with no open port and a free tier, at the cost of a third-party coordination service.

Option 5 in detail: internal only

Add an internal DNS record for signage.yourdomain.com on each network’s DNS. You can still get a trusted certificate without exposing anything: Let’s Encrypt’s DNS challenge proves domain ownership through a DNS record instead of an open port (installer TBD: DNS-challenge support planned).

No domain yet?

Register one at any registrar; a .com runs roughly $10–20 a year. Use a subdomain of it for signage and nothing else needs to change on your website.