Leaderboard

Hello all! We are excited to announce HexOS Local, powering the new local UI/UX for HexOS and capable of so much more. Read more about it on the Blogpost - Introducing HexOS Local

Let's Talk About Immich If you've been running Immich on HexOS this year, you know it hasn't been smooth sailing exactly. We want to talk about what's happened, why it was so challenging, and how we're working to handle these situations better in the future. What Happened? Earlier this year, Immich deprecated their old storage configuration and required all users to migrate to a new structure. For users running Immich through docker-compose or other manual setups, this meant updating some configuration files and running a few commands. Annoying, but manageable. For some HexOS users, the migration was more involved. Because of how TrueNAS SCALE structures application storage, moving to the new configuration required either reinstalling Immich fresh (the simplest solution) or manually migrating existing data between datasets (a process that involved SSH access, rsync commands, and careful attention to permissions). But if you're choosing between "reinstall the app" or "follow a 15-step guide," neither option feels great when you chose HexOS specifically to avoid that kind of complexity. Why Was This So Hard? When Immich made this change, we had a choice to make. We could have built a comprehensive rsync-based migration tool using the TrueNAS API. It has those capabilities. But that would have meant dropping everything else we were working on to build what amounts to using a cannon to kill a mosquito: a massive, complex solution for what we hope won't be a regularly recurring problem with this particular app. Instead, our community stepped up in a huge way. Users like @forsaken and @G-M0N3Y-2503 created detailed guides (to move or rsync your data). These guides walked through the manual migration process to preserve existing data in Immich. They focused on helping users through the immediate problem, while we continue building the platform we need to handle situations like this properly. That platform is HexOS Local: a locally-hosted management application that will let us perform complex operations without being bottlenecked by the engineering overhead of building one-off solutions through the SCALE API every time an application throws us a curveball. This reduces the technical burden on our team and, more importantly, gives us the flexibility to automate maintenance tasks that previously would have required manual intervention or massive engineering investments. This same platform will serve the Local UI/UX feature we've committed to delivering as part of our 1.0 release. We'll be talking a lot more about HexOS Local in an upcoming blog post, but the key takeaway is this: we're building HexOS to handle whatever the open-source ecosystem throws at it, without having to choose between "drop everything and build a custom tool" or "make users SSH into their servers." What About Right Now? If you're currently running Immich on the old storage configuration and haven't migrated yet, you have options: The simple path: Reinstall Immich fresh with the new configuration. Your photos will need to be re-uploaded, but the setup is clean and straightforward. The preservation path: Follow one of the community migration guides to keep your existing data in place. These guides are more technical and require command-line access, but they work. Our recommendation depends on your situation. If you have a manageable photo library and good backups, the fresh install is probably your best bet. If you have years of photos, carefully organized albums, and user configurations you don't want to recreate, the migration guides are there for you. And if this seems to daunting, email support@hexos.com so we can schedule a time to assist you directly. Moving Forward The Immich situation showed us exactly where we need to invest engineering effort. We can't keep facing the choice between building massive one-off solutions or asking users to break out the terminal. That's not sustainable, and it's not the HexOS we're building. Immich is an incredible project. It's exactly the kind of self-hosted solution we want to make accessible to everyone. The team behind it recently released v2.0, marking their stable release with better upgrade paths going forward. We're committed to making sure that when the next complex maintenance task comes up, whether it's Immich or any other application, we have the infrastructure in place to handle it gracefully. That's the HexOS we're building. Thanks for your patience while we get there.

Forgive me, but I'm really confused by what you're saying, which means there is clearly a disconnect in our marketing language and understanding with customers as well and I want to get to the bottom of that. Let's try some clarification here: Buddy backup is a feature that will allow two HexOS users (customers) to backup to each other's server in an encrypted fashion. There is no reason you cannot be your own buddy with a second license (e.g. you buy a second server license and put a server at a secondary location). If someone bought two licenses during black friday under two separate accounts, each account can backup to each other just the same (and if they want to merge those two accounts, we can handle that for the user). With this sale, however, we are not allowing someone to buy a second license to transfer to another user (as it would open the door to reselling licenses which we don't support). I get that the term "buddy backup" may not clearly identify that you can be your own buddy, but we thought it would be fairly obvious that if you could backup to someone else on a separate account, you could also backup to yourself on the same account. I think we could loosen the "encryption" requirement in the case of backups between two servers owned by the same account, but that's more of a technical detail than marketing. Let me know what's still unclear or how we can do better on the language here. Sometimes we can be a little too close to the trees to see the forest, so if you can help give us a better perspective, we'll work to improve our messaging in the marketing. Thanks!

Buddy backup will definitely work with two licenses under the same account. You will be your own buddy 😉

OMG, I totally see the confusion now. I have edited that post and reworded it to be more clear. TrueNAS has no built-in means to do backups as part of their OS unless you consider rsync cron jobs/replication tasks as "backup". They don't facilitate the connection between servers or even setup the SSH permissions for you (you have to do all of that yourself). This is where our solution takes things a step further. We intend to make the experience much simpler. First you "friend" someone else that is a HexOS user (if you're doing the "buddy" approach). Then you will grant that user "permission" to backup to your system (and set a quota). Then they accept the request and authorize the backup in return (if you're doing that). Then we do the rest (establishing a secure VPN tunnel between systems, creating appropriate SSH users and handling the key exchange, etc.). You'll definitely be able to leverage the buddy backup system between two systems licensed under the same account. That would be silly of us to prohibit or unnecessarily complicate. I get the confusion. Buddy backup is just the marquee feature name for our backup solution between two servers. Every server needs a license. So if you and a buddy want to backup, you both have to have your own licenses under your own accounts. If you have two licenses for two systems under 1 account, you can use the same "buddy backup" system to handle that job as well. Apologies for muddying the water on my initial response. I can see how that had some folks confused, but I hope this clarifies.

It's hard to believe it's already been a year since we launched the HexOS Beta and the early access campaign. What a journey it's been! In today's blog post, we're going to provide a summary of this past year's accomplishments, a run-down of what's left to achieve our 1.0 release, what's coming next, an update on the AnyRaid project, and our HexOS Holiday Sale! Read all about it in our latest blog post: https://docs.hexos.com/blog/2025-11-26.html

Another mid-quarter update featuring: New curated app installations Update to the qBittorrent installation Read more about it on our docsite here at Command Deck Update - November 25, 2025 NOTE: This update was applied automatically. You may need to clear your cache.

To celebrate the holidays and thank our community for their continued support, we're excited to announce our HexOS Holiday Sale, starting today! Existing customers can purchase additional licenses for just $99 each, perfect for expanding your home server setup. New customers can take advantage of our special two-pack bundle for $298, with additional licenses available at the same $99 promotional price. Single licenses remain available at $199 until our 1.0 release in Q1 2026. This holiday pricing for additional licenses and the two-pack bundle is available through December 31st, so don't miss out on this opportunity to join or expand your HexOS experience. Please note: License transfers are not permitted. All licenses are tied to the purchasing account. Buy now from the HexOS Store!

The difference is pretty big, while they do the same thing, they do it very differently. Immich just stores all the images in plain on the file system, all the processing is done on server side, you can connect an external library and if your Immich DB or installation becomes corrupted or breaks and there is no more support for Immich you just take the photos folder and move on. But the admin and everyone who's access to the folder can see all the photos of everyone, so privacy is not that great, but administration is easier and recovery in case of an issue is easy. Ente (FunFact: Ente is German for Duck) is all about privacy. The photos are all encrypted on the server and only the client side can decrypt/see the photos. This also means that the client side needs to do all the processing, but therefore the server can be very low spec (although this doesn't matter in our case, because Hexos needs to run in the first place, so HW specs is not really a concern in any way) and it needs S3 storage and requires more setup an administration. However if your Ente DB becomes corrupted or the Ente app breaks or the Ente dev stops and your app becomes unusable, you lose all your photos, because you cannot access it any other way. But until that happens only your client side device can access the photos and no-one else can.

Just got off a call with a few of the Eshtek guys, they set me straight very quickly. Before I called them, I dove into what others here have done. Here is what fixed the router swap for me: Sign into the TrueNas Scale Web UI. Go to Network: Go to Global Config settings: Change Nameserver1 and IPv4 Default Gateway to the IP address on/of your router. My issue was that I kept changing the NAS IP address to the IP of the NAS, not the router. Essentially, I was signed into my router interface, looked up what the NAS IP address was, and kept changing the Nameserver1 and Default gateway to that IP, when I should have been setting it to the IP of the router. Once that is done, my NAS found the internet again, the HexOS deck found a server and I was set! I had to skip the initial setup in order to prevent wiping the drives, but I was saved. Thanks to Nick and Eric!

Wait, so if I have two licenses under my account I can't put my second server at eg my parents home for a offsite backup and sync via BuddyBackup?

As of today, yes, you can access your server from anywhere using deck.hexos.com. I have a discussion planned with the team to allow you to disable remote access which would be as simple as us verifying the WAN IP of the client device being used to connect to the deck and making sure it matches the server's WAN IP. When HexOS Local arrives, you will be able to even further reduce your cloud dependency, but there are some features like installing apps/VMs, configuring buddy backups, and e-mail notifications that will require a connection to our deck. Thankfully that connection is outbound from your server, which doesn't require you to open any ports on your firewall and expose the system to the wider net. We also do have plans to implement oAuth and 2FA in the future to further enhance security and options.

We know about this problem all-too-well. The VM features will come in layers, but our plan is to try and get ahead of those kinds of problems by detecting hardware changes and automatically adjusting device ID mappings to your VMs before they start. This still needs a lot of R&D work and there are lots of potential gotchas, but I bet we can address a lot of common scenarios like what you've described. It gets more tricky when you have multiple GPUs in a system of the same make/model, as it's hard to know which one is which for assignment to VMs. I'd say that's a problem for after the initial VMs feature release for us to investigate further. Ultimately there will be some limits to what we can do, but we're going to do this as best as is humanly possible.

Correct. The additional licenses is for users that want to setup multiple systems of their own, not for buddy backups. @Todd Miller rightly called this out as confusing. What I meant to say is that you just can't transfer the license to another user. You can use buddy backups (as a feature) between two systems that you own and control (licensed under one account). Sorry for the confusion! Carry on!

Def not cloud only. If your isp/network supports peer to peer, we can coordinate that and then get out of the way. That is what's included in a lifetime license. If we end up having to relay traffic for some users, that will require a subscription as we will have to pay for the relay traffic, but obviously it will still be encrypted.

Pretty disappointed with this limitation. I understand the reason to avoid unscrupulous reselling, but I do think there are better ways of avoiding that without these issues. There are probably a lot of people in a similar situation as me; wanting to get a license for a relative as the family tech guy, but not wanting to have to be the sys admin for everyone. I bought a license at release because I support the mission, with no intention of using it until the features got more flushed out (still on plain TrueNAS). I am in the process of building a NAS for my father, which I intended to set up with a HexOS license so he could use buddy backup and some apps as a relatively nontechnical user. The HexOS interface is simple enough I think he can grasp it. But if I have to be an admin for his NAS anyway I might as well just set up Tailscale and rsync on TrueNAS. I understand it's a sale price and I'll probably end up getting him his own but it just feels like a slap for people that bought in to support and I hate feeling like I'm throwing money away. I'm no business major but it seems like expanding the user base would be prioritized given the possibility of genuinely useful subscription features coming down the pipe. Anyways. Just my $0.02. Still love what you guys are building.

Thanks for confirming and apologies to anyone that was confused. If anyone bought another license at $199 on accident today, send an email to support@hexos.com and we'll get the difference refunded.

No its not over. We are investigating why the correct pricing isn't showing up for users. Stand by.

The backup stuff sounds great, any serious system should have the ability to backup and restore, especially when apps like Immich are being recommended, seeing away to back all this stuff up would make HexOS a serious contender in the networking and diy nas space, maybe even business

at this time your best option would be using the in app backup and restore functions and then reinstalling it if you would like to migrate. But i will be sure to let the team know that users are interested in migrating over to curated versions of the apps.

I would like to see first party support for placing any app behind some of the most popular VPNs (PIA, Nord, Express, Proton, Tailscale, etc), as well as custom VPNs (WireGuard, OpenVPN, etc). For example, you may install “The Lounge” IRC client and have all internet communication pass through a PIA VPN so that your home IP is not exposed while chatting. Traditional methods of doing this involve painful configuration of iptables or other firewall rules. I believe this is an area where HexOS could really simplify things: Install a VPN plugin, authenticate with it, and then simply assign an app to a VPN plugin via the app’s settings if desired. It would be fully accessible from the home network without going through the VPN, but all internet traffic would go through the VPN with a kill switch in case the VPN goes down. Thoughts?

If there are still a plethora of users affected after Local is released, we would consider it. But if not, we would rather spend the time via support helping people up over this fence than engineer an entire solution for a handful of folks. Support@hexos.com is available to you at no cost.

That thought did occur to us, but to be perfectly honest we'd rather anyone not comfortable following the guides or having difficulty to just contact us directly for support. That's what you all paid for and we are gonna provide it. I don't want to start asking our users who aren't comfortable to navigate the TN interface.

I ended up having to reinstall Immich (twice, for some reason, the second seems less likely to be hexos related), so I appreciate you being up-front with acknowledging that it was… not fun. Daunting was probably the right word for it. I usually consider myself tech savvy so being so totally out of my depth was frustrating in a way I’m not used to. A suggestion: some folks might be having trouble completely uninstalling/reinstalling (I did) so a simple guide on how to do that might be helpful, even if it’s just “hey delete this dataset” - I’m sure the advice exists in the forum but there are a lot of things to search through to find it. If I remember right, uninstalling/reinstalling on the hexos deck didn’t fix the underlying issue or delete the underlying data. I’ve seen the pace of updates and the pace of communication improve over the last few months - which makes it easier to assume best intent. I look forward to what’s coming next (and hopefully no other apps break that bad)

We now have one: Custom Install Scripts - HexOS Hub

It's here!!! https://forums.truenas.com/t/truenas-25-10-1-is-now-available/60830. Can't wait until this is integrated into HexOS!

yes you would need to either go back to the 192.168 subnet or Vlan for the hex os port to run as 192.168 and make the ACL's to connect back to the 10.10

Not possible. License transfers are not permitted. All licenses are tied to the purchasing account.

Would be great if we could get ente photos support just like immich. I tried to set it up myself but couldn't. Here's the link: https://ente.io/help/self-hosting/

There is no announced timeframe at this time. The benefit is being able to make bigger pools.

Hey, no this will not work as you've described it. With 2 drives Hexos will automatically create a mirrored pool, meaning your data will be stored on both drives at the same time and you will only have the capacity of 1 drive but you can lose 1 drive without losing data. You cannot create a Pool without parity with more then 1 drive. A RaidZ Pool type cannot be changed after it was created, so you will be stuck with your mirrored pool and you cannot expand it. If you then throw in your 4 drives from the old NAS, Hexos will create a new RaidZ1 pool, which has the capacity of the numbers of drives -1 (capacity of 3 drives in your case). You can then copy the data from your mirrored pool to your RaidZ1 pool. If however, your mirrored pool does not have enough capacity, get yourself a 3. drive to create a RaidZ1 from the beginning, copy your data over and afterwards add your drives from your NAS to the pool or create a new pool. (expanding a pool can only be done with 1 drive at a time and takes some time). Also make sure all your drives have the same capacity or else Hexos will not group them together.

@ThoDC If you haven't already, email support@hexos.com and they will schedule a time to work with you on this. See

there aren't any risks to unclaiming a server. whenever you reclaim it just be sure to use the skip setup button. seems like you have the bug discussed in this post Hopefully the solution there solves your problem

Thank you 2nd License bought 😈

This is now showing correctly for me. Thank you!

@wvienna @FangerZero can you guys check again and let me know if the discount shows up correctly for you now?

Amazing news. I just hope adding HexOS Local will be seamless and won't require a fresh install/rebuild!

Just here to say - you guys are awesome and thanks for keeping your promises! I'm perfectly fine with deck and enjoy being able to pull up the stats quickly anywhere I am, but local hosting is so important to this community, so thank you.

1 system/installation requires 1 license. And Buddy Backup is between 2 systems requiring a license each. The owner doesn't matter all you need to have is 2 Hexos installations/servers therefor 2 licence in total and you are good to go for buddy backup.

no worries Biem, moved you to the right spot So seems like you have a fairly common use case withI he addition of game servers. The requirements for game servers do differ depending on game and the scale (like if you plan to make a sever say 100+ will join) so you may want to look up that part yourself As for the rest you should easily get by with some of the cheaper intel cpus available something like an intel i5 8400 or 8500 should be more than strong enough those intel cpus have integrated gpus so you don't have to spend extra on a graphics card and they support intel quick sync which just means they are great for plex. Make sure any motherboard you get does not have a realtek nic (network interface card), you can usually find out on the motherboard webpage or on the pcpartpicker page for the motherboard. for cases i like recommending the jonsbo n4 since its a fairly compact case that has 6 hdd bays and a relatively good value. The downside with the n4 is that it will only fit smaller sized power supplies and motherboards which may cost more than full size. for you boot drive i suggest getting a cheap and small ssd. any space left over on it after the os is installed cannot be used. I would suggest no less than 16gb of ram for you. now depending on your budget you could get a stronger cpu or more ram.

At this time the recommended way to update the path is to uninstall and reinstall but you shouldn't lose any data if you uncheck remove app settings and data.

I wonder if Eshtek is ready to have an app store separate of TrueNAS. This would require them to have a much larger responsibility in situation where an apps author make a move like the Immich issue. This doesn't seem to be likely because what does Eshtek get for this immense extra effort? Just more work and responsibility it seems.

Hmm. It sure seems it took a long time to come to this. And along the way many have already rejected this uninstall/reinstall approach assuming you would eventually have to fix this. Since this is a situation that we are most likely to encounter again do you have a plan to get the Eshtek response out before the forums are reduced to a dozen large arguments? You may not know what issues are coming but you do know months of silence has proven o be a bad situation.

I haven't used Nextcloud or Opencloud but I imagine their file management solutions are similar to Google Drive. Paperless-NGX is like the "more advanced organization" option compared to Google Drive from my point of view. Paperless allows you to ingest documents through a variety of means (upload button, watched folder, reading emails and automatically saving attachments or the email based on rules). Then it tries to apply machine learning to extract the document date and other info like who the document is regarding, what kind of document it is, where it should be stored, all based on what you have manually added metadata for. If I have a receipts document type, it will learn what I consider a receipt and assign that automatically. It also OCRs all the documents and stores the text so it's searchable later. You can add custom metadata fields like a global document ID (I'm told). You can then search, view, organize, share these documents in the paperless web UI. You can customize how it stores all these documents on disk so you can still access them outside of Paperless if you want. There are a few apps that allow direct "scan to paperless" functionality with decent cropping. You don't scan documents so each page is a file. You ingest a PDF with multiple pages normally so you would scan with your phone or a scanner, then import to paperless. Though you can ingest images and other stuff.

Could we get a forum section for install scripts? That way as a community we can post a thread for a specific app and people can share their scripts and ask for feedback? I think that'd be handy, but I don't think it needs to go in the normal Applications support forum because that might confuse people as it's definitely a more advanced thing at the moment! Thanks

I am not seeing 2FA/MFA, despite it being discussed as part of the Q1 release plan. Is there a way to enable this that I am missing?

I'll just answer myself. It is. I had previosly updated TrueNas to Fangtooth which is not supported and I messed up the boot pool so I wanted to reinstall but was worried about it (I was thinking on just dropping HexOS and use TrueNas directly with the latest version). I was able to reinstall everything following these steps (I had a recent copy of the truenas config): Follow steps 1 to 6 Update TrueNas from the UI to Fangtooth Reimport TrueNas config profit This was easier than I though and I didn't lose any data.

I would also want to do this on a router level But for this the 'Apps' should get it's own IP address, then in the router (unifi) i can traffic them trough the VPN So I would love to be able when installing an app, to have the possibility to let it get it's own IP Then i could make a VLAN for al the devices that needs to go over the internet trough an VPN

UPDATE: As of 11/8, we have updated the ISO installer to run on version 25.04.2.6 of TrueNAS SCALE. Existing users should NOT reinstall to get this version. You can update from within the Activity card on the Dashboard (or the Notification). Hello and thank you for joining the HexOS beta program! You are an elite and vital part of this project and your participation is greatly appreciated. This post contains all the information you will need to get started with HexOS and how to communicate with our team during your beta experience. Disclaimer Beta Products, Software, and any related Services are still in development, and therefore, you are advised to safeguard important data, to use caution, and not to rely in any way on the correct functioning or performance of the products, software, or any related services. Beta Products and Services are provided to you “AS IS”, without any warranty whatsoever. Expectations During your participation in the beta, we expect you to do the obvious: use and test the software. But we also expect you to communicate with us when things don’t go right or if you’re having trouble. Please post feedback and let us know about your experiences, good and bad. That being said, please remember that this is beta software and early access. HexOS has a long and healthy roadmap ahead. Quickstart Guide For those that just want to get started, here’s the TLDR: Download the ISO here: https://downloads.hexos.com/TrueNAS-SCALE-25.04.2.6-HexOS.iso or https://hexos-downloads.sfo3.cdn.digitaloceanspaces.com/TrueNAS-SCALE-25.04.2.6-HexOS.iso (SHA256 Checksum: e8ed99a322affe0969b82b866161a9f6acbc1561e3cc7b2efb2bf120ffe2e856) Use a tool such as Balena Etcher to image a USB flash device with the ISO. Boot your server from the flash device and install the OS to preferably an SSD. When given the option, opt to create the admin password in the installer (do not select the option to "Configure using WebUI"). Remove the flash device and reboot your server when the install is complete. From another device (mobile, tablet, desktop) that is on the same LAN as your server, login to https://deck.hexos.com using your HexOS credentials. Follow the instructions to complete your server configuration. NOTE: As of the 24.10.2.2 build of this ISO, configuring the admin password via the webUI option has been removed from the installer. However, if you select to create an admin password, but then attempt to "cancel" that process, the ISO will proceed with an installation with no admin password set. This is a known bug and the TrueNAS team will be addressing this in a future update to the ISO. Just don't cancel out of creating the admin password in the installer ;-). Hardware Requirements Booting HexOS is designed to support a wide variety of x86 hardware (Intel or AMD). The minimum requirements are a 2-core 64-bit CPU, 8GB of memory, and a 16GB or larger SSD boot device. However, depending on your needs for performance and applications, more resources may be required. Storage Pools Pools are made up of storage devices based on size and type (HDDs vs. SSDs). Storage devices in each pool need to be roughly the same size*. The OS boot device cannot be a part of a pool. Expandable pools require a minimum of 3 devices and can be grown one device at a time. Non-expandable pools can be created with 2 devices. Initial pool width should not exceed 8 devices. Maximum expanded pool width should not exceed 12 devices. At least one storage pool must be created to use HexOS. *In the event of slight variations (e.g. 240GB and 256GB), devices can be grouped, but total capacity for the pool will sacrifice the larger device’s excess storage. Build Recommendations HexOS has been designed so that a relatively modern PC can be easily transformed into a very viable home server. This means using standard HDDs/SSDs and using onboard controllers for storage/networking. However, since we’re based on TrueNAS, our hardware support is actually rather vast. For more detailed hardware recommendations for advanced builds, please refer to the TrueNAS SCALE Hardware Guide. Installing in a VM As HexOS is based on TrueNAS SCALE, it can be installed as a virtual machine as well. While the process should be fairly self-explanatory, please see the TrueNAS SCALE documentation for additional instructions on VM installation. Setup and Configuration Once the OS has been installed and rebooted, you will use a web browser on the same network as your server to register your system and complete the setup process. This can be a PC, tablet, or mobile device. Using a capable browser, login to https://deck.hexos.com. Beta 1 Features Our first release is focused on providing a streamlined user experience for setup and configuration and laying the framework for what’s to come. The main features of Beta 1 include: Setup and configuration wizard Configure your home server in minutes with ease. Analyze system health, with warnings for SMR HDDs. Auto-configure storage pools to safeguard against device failures. Securely manage your server remotely via Command Deck. Storage device management Detect error states and conditions and report through the dashboard Highlight individual storage devices and their respective faults Replace devices from storage pools due to failure or preventative maintenance Expand pools as little as one device at a time Folders and users Create and share folders over your local network. Easily manage permissions for secure access. Apps One-click deploy Immich as a personal photo library app. One-click deploy Plex as a home media server. Automatic folder creation for app storage. Dashboard / UI Access key statistics like CPU, memory, network, and storage usage at a glance. Monitor storage health and see alerts for errors or degraded pools. Manage multiple servers from a single, unified interface. Enjoy mobile-responsive design for effortless navigation on any device.

Cloudflare is awesome, and I definitely want to see native support for Tunnels. It is fairly simple for a technical person to setup but it would be nice to have a wrapper within HexOS for like a one-click setup. Basically you buy a domain in Cloudflare, link your account to HexOS and it will perform the necessary config to setup the tunnel, route application services to your domain, and apply ACLs based on what you already have in HexOS. Although, you do need a domain to use Cloudflare Zero Trust. Tailscale is another option, and does not require a domain to use. As of right now the docker app already runs great. I imagine they could add a simple wizard—the current setup process has a lot of options but only requires an auth key to be set for it to work.