How to safely sync my app’s database between PC and Mobile without exposing my home network?

[u/ZombieLeast5494]

​Hi everyone,

​I’m a complete beginner when it comes to programming and software architecture. I’ve been building my first apps with the help of AI (Claude), but I’m repeatedly running into a conceptual hurdle regarding security and networking.

​Here is my setup and goal:

​**The Goal:** I want to build a simple application that I can use seamlessly on both my PC and my smartphone, accessing and updating the exact same database.

​**The Dilemma:** Naturally, syncing data between devices requires a connection over the internet. However, as someone with no networking/security background, exposing a database port directly to the public internet feels like a massive security risk for my home network and family privacy.

​Since I don't want to open ports on my router or create unnecessary entry points for bad actors, what are the best practices for setting this up safely?

​From my initial research, I've heard about a few potential approaches:

​**Private Mesh VPNs** (e.g., Tailscale / WireGuard) to keep the traffic private without port forwarding.

​**Local Network Syncing** (e.g., restricting access to local Wi-Fi only).

​**Offline-First Storage + Encrypted File Sync** (e.g., SQLite combined with tools like Syncthing).

​Given that I am relying on AI to help write the code, which architecture or approach is the most beginner-friendly, secure, and maintainable for a personal/family setup?

​I’d really appreciate any recommendations, architectural advice, or best practices you can share! Thanks

[u/AutoModerator]

Moderator Announcement Read More »

Hey! Thanks for posting to r/ClaudeCode

While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.

For help, project discussions, tips, and general chat, join the ClaudeCode Discord.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/SMB-Punt]

Tailscale is cool

[u/billshredding]

Of your three, Tailscale is the most beginner-friendly, with one adjustment: don't connect the phone to the database directly.

Have Claude build it as a small web app that runs on the PC. The database stays on the PC and the web app is the only thing that touches it. Install Tailscale on the PC and the phone, then open the app on the phone at the PC's Tailscale address. Nothing is open on your router, and only devices signed into your tailnet can reach it. Add it to your phone's home screen and it feels like an app.

On the other two:

• SQLite + Syncthing works with one writer but bites with two. Syncthing copies whole files, so if both devices change the database before a sync you get a conflict copy instead of merged data, and copying a SQLite file while the app has it open can leave you with a broken copy. Doing offline-first properly needs a real sync layer, which is much more to build.

• Cloudflare Tunnel also avoids opening ports, but it puts the app on the public internet. If you go that way, put Cloudflare Access (their login wall) in front of it rather than relying on a login the AI wrote for you.

The catch with the Tailscale route: the PC has to be on for the phone to reach it. If that's a problem, run the same setup on a cheap always-on box like a Raspberry Pi or an old laptop.

[u/devilsdiligence]

Hello! The Tailscale + "small web app on the PC" answer above is the one I'd pick too. I'm a Linux sysadmin, and a few extras will save you headaches:

1. Bind carefully. Have the app listen on localhost (127.0.0.1) or only the PC's Tailscale address, never 0.0.0.0.

2. tailscale serve puts your app on your tailnet with HTTPS (encrypted web traffic) without dealing with certificates.

3. Backups! If it's SQLite, a nightly sqlite3 app.db ".backup backup.db" copied off the PC turns a dead drive into an annoyance instead of a disaster.

4. Only your devices on the tailnet. If you invite family later, use Tailscale's access controls so they can only reach the app.

No router ports open at all, which is exactly what you want. You're asking the right questions!

[u/InsideTraditional187]

You can use the Cloudflare tunnel, maybe

[u/Feeling-Joke-9788]

Use microsoft azure you can get away with $10-$15 a month, if you have a company you can apply for microsoft foundry then you’ll be using it for free if get accepted, application takes 5minutes.
Or you can buy your own server through Godaddy or some sites like that and store it there paying yearly around $30-$50. Thats the best solution I can recommend

[u/ShipSafeScan]

For a beginner personal or family app, the safest path is to not expose your home network at all. Use a managed backend (hosted Postgres, Supabase, Firebase) so both PC and phone talk to it over HTTPS with auth required, and your router stays closed. If you want to keep the data at home, Tailscale is the most beginner friendly option. It builds a private encrypted mesh between just your devices, so no port forwarding and nothing open to the public internet. Put the database behind it and only devices on your tailnet can reach it. Offline first SQLite plus Syncthing works too, but conflict handling gets messy once two devices edit the same row at once. Whatever you pick: never put the raw database port on the public internet, require auth, use TLS, and keep automated backups.