CleanCut Suite

Use CleanCut from your phone, at home or away

CleanCut's dashboard (its page in your web browser) works on a phone, so you can check on things, find a movie, or approve your kids' requests from the couch or from the other side of the country. This guide shows you how, one step at a time. You don't need any experience with Linux, CasaOS or home servers.

In short

  • At home there's nothing to set up: open CleanCut in your phone's browser.
  • Away from home, the free Tailscale app links your phone to your server privately. You set it up once, in about 15 minutes, with no changes to your router.
  • Phone apps such as Helmarr (iPhone and iPad with iOS 26 or later) and nzb360 (Android) are optional. CleanCut can let them in with one switch, and shows you exactly what to copy into them.
  • This guide is about managing CleanCut. Watching your movies away from home happens in the Plex app, which needs Plex Pass or Plex's Remote Watch Pass for that; see plex.tv.

On this page

  1. Words you'll see
  2. At home: open CleanCut on your phone
  3. Away from home: set up Tailscale
  4. Phone apps: Helmarr, nzb360 and similar
  5. Family requests with Seerr (optional)
  6. Is this safe?
  7. If something doesn't work

Words you'll see

Each word is explained again where it first comes up.

  • Server: the computer at home that runs CleanCut all day.
  • Dashboard: CleanCut's page in your web browser, at http://<your-server>:8585.
  • IP address: a device's number address on your home network, such as 192.168.1.50.
  • Port: the number after the colon in an address, such as :8585. It tells the server which app you want.
  • Tailscale: a free app that makes a private, encrypted link between your own devices, so your phone can reach your server from anywhere.
  • Tailscale name: the name Tailscale gives your server, such as casaos. You use it in addresses instead of the IP address.
  • API key: a long password that lets one app talk to another. Keep it private.
  • Path (also called URL base): the part of an address after the port, such as /sonarr. It tells CleanCut which built-in app a phone app wants.
  • SSL (or HTTPS): a setting in phone apps for encrypted web addresses. Leave it off for CleanCut. Tailscale already encrypts the connection when you're away from home.

At home: open CleanCut on your phone

This takes about two minutes and needs nothing new.

  1. Make sure your phone is connected to your home Wi-Fi.
  2. Open your phone's web browser (Safari on iPhone, Chrome on Android).
  3. Type CleanCut's address, the same one you use on your computer, for example http://192.168.1.50:8585. Type the whole thing, including http:// at the start and :8585 at the end. (If you changed CleanCut's port in your app store, use that number instead of 8585.)
  4. Sign in with your parent password.
  5. To see all of CleanCut's pages, tap the » arrows at the top left, next to the CleanCut logo. The page list slides open: Home, Find something to watch, Downloads, and so on.
  6. Optional: put it on your home screen so it opens like an app.
    • iPhone (Safari): tap the Share button (the square with an arrow; on newer iPhones, tap ⋯ first, then Share), then Add to Home Screen.
    • Android (Chrome): tap the ⋮ menu at the top right, then Add to Home screen.

The kids' page. CleanCut's Kids & Plex page shows a link that ends in /?kids. Open it on your child's tablet and add it to the home screen the same way. Your kids can search and ask for titles there, and nothing else. You approve or decline on the Requests page.

Away from home: set up Tailscale

What it is. Your home network is private: from outside, nobody can reach your server, including you. Tailscale is a free app that fixes that safely. You install it on your server and on your phone and sign in to both with the same account. From then on, your phone can reach your server from anywhere, as if you were at home. The link between them is encrypted (scrambled so nobody else can read it).

What it isn't. Tailscale is a different thing from a VPN service you might pay for. A VPN service keeps your home internet address private when CleanCut downloads (that's optional). Tailscale only connects your own devices to each other. If you use both, they work side by side.

What it costs. Tailscale's Personal plan is free for personal, non-business use.

Before you start, open CasaOS (or your server's app store) on a computer, and keep your phone nearby.

Part 1: make a Tailscale account (2 minutes)

  1. Go to tailscale.com and click Get Started.
  2. Sign up with an account you already have: Google, Microsoft or Apple all work. Remember which one you picked: you'll use the same one on your server and on your phone.

Part 2: put Tailscale on your server (5 minutes, once)

CasaOS (and ZimaOS): Tailscale is in the official App Store.

  1. Open CasaOS (or ZimaOS) in your browser, open the App Store, search for Tailscale, and click Install.
  2. When it's installed, click the Tailscale icon on the home screen. Tailscale's own page opens in a new tab.
  3. Click Log in and sign in with the Tailscale account from Part 1. When you're back on Tailscale's page, it shows your server as connected.

Or with two commands (if the Tailscale page doesn't offer to sign in, or you prefer it). It takes about two minutes.

  1. Open a terminal on your server, the same way you did to install CasaOS: on the server's own screen and keyboard, or from your computer with ssh (see Don't have CasaOS yet? in the install guide).

  2. Type this command and press Enter. It downloads and installs Tailscale:

    curl -fsSL https://tailscale.com/install.sh | sh

  3. Type this command and press Enter. If it asks for your password, type it (nothing shows on screen while you type; that's normal) and press Enter:

    sudo tailscale up

  4. It shows a link starting with https://login.tailscale.com. Open that link on any phone or computer and sign in with the Tailscale account from Part 1. The terminal says Success when it's done, and you can close it.

Unraid, Synology or TrueNAS: Tailscale is in your server's app store too (Unraid: the Apps tab; Synology: Package Center; TrueNAS: Apps). Install it and follow its sign-in steps. Tailscale's own guide for each one is at tailscale.com/docs/integrations/nas.

Windows or Mac: on the computer that runs CleanCut, install Tailscale from tailscale.com/download and sign in.

Raspberry Pi or other Linux: open a terminal (a window where you type commands) and type these two commands, pressing Enter after each one. Then open the link it shows to sign in.

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Recommended: stop Tailscale from signing your server out. For safety, Tailscale asks each device to sign in again every few months. That's fine for a phone, but your server is usually out of sight, so turn it off for the server:

  1. Go to login.tailscale.com/admin/machines and sign in. This is the list of your devices (Tailscale calls them machines).
  2. Find your server's row and click the ⋯ menu at the far right of it.
  3. Choose Disable key expiry.

Part 3: put Tailscale on your phone (3 minutes)

  1. Install Tailscale from the App Store (iPhone) or Google Play (Android).
  2. Open it and sign in with the same account you used for the server.
  3. Your phone asks whether Tailscale may add a VPN configuration. Allow it: that's how Tailscale makes its private link.
  4. Make sure Tailscale is switched on in the app.

Good to know: a phone runs one VPN app at a time. If you use another VPN app on your phone, turn it off while you use Tailscale.

Part 4: open CleanCut from anywhere

  1. Find your server's Tailscale name. Open the Tailscale app on your phone. It lists your devices by name, and your server is one of them, for example casaos. (The same list is at login.tailscale.com/admin/machines.)
  2. Open CleanCut with that name. In your phone's browser, type http://<your server's Tailscale name>:8585, for example http://casaos:8585. Sign in with your parent password.
  3. Name won't open? Use the server's Tailscale address instead. It's four numbers that start with 100., shown next to the server in the same list, for example http://100.101.102.103:8585.
  4. Test it away from home. Turn off Wi-Fi on your phone for a moment so it uses mobile data, and open the address again. If CleanCut opens, you're done.
  5. Save it. Add this address to your home screen (see the steps above). It works at home too, as long as Tailscale is switched on, so it can be the only bookmark you need.

You'll find a short version of these steps inside CleanCut: Settings → Connection → Remote access.

Phone apps: Helmarr, nzb360 and similar

Do I need this? No. CleanCut's own pages already do everything in your phone's browser. This part is for people who like a dedicated phone app.

What's behind CleanCut. If you let CleanCut find and download new titles (it's optional), five well-known apps run behind its simple pages. People usually install and connect them by hand:

  • Radarr finds movies.
  • Sonarr does the same for TV shows.
  • Prowlarr keeps the list of search sites you added.
  • qBittorrent does the downloading.
  • Bazarr fetches subtitles.

CleanCut sets them all up for you and keeps them out of sight. Phone apps such as Helmarr (iPhone and iPad with iOS 26 or later) and nzb360 (Android) are made to talk to these apps directly. Both are free to download, with paid upgrades for extra features; their store pages have the details. Other phone apps made for Sonarr and Radarr connect the same way. On an older iPhone, use CleanCut's own pages in Safari instead (see At home above).

Everything you add through a phone app is still cleaned before your kids can see it.

Step 1: switch on phone apps in CleanCut

  1. Open CleanCut (on your phone or computer) and sign in.
  2. Open the page list (on a phone, tap the » arrows at the top left, next to the CleanCut logo). Under Setup, choose Settings.
  3. Open the Connection tab. On a phone, swipe the row of tabs to the left if you don't see it.
  4. Scroll down to Phone apps and request services.
  5. Switch on Allow phone apps and request services. CleanCut says Turned on.

Step 2: see what to copy

As soon as the switch is on, CleanCut shows everything a phone app asks for:

  • A line that starts In your app, add each service with and gives the Host (your server's address) and the Port. The host is the address you used to open CleanCut, so if you opened it with your Tailscale name, the Tailscale name is shown.
  • A table with one row per service: Service, Path and API key / login.
Service Path What to paste
Sonarr (TV shows) /sonarr its API key
Radarr (Movies) /radarr its API key
Prowlarr (Search sites) /prowlarr its API key
Bazarr (Subtitles) /bazarr its API key
qBittorrent (Downloads) /qbittorrent username admin and the password shown

API keys are long. Copy and paste them rather than typing them, and copy the whole key.

Step 3: add the services to your phone app

In your phone app, add each service and pick the matching type (Sonarr, Radarr and so on). Phone apps ask for the address in one of two ways:

  • One address box: type it all together, as http://<host>:<port><path>. For example http://192.168.1.50:8585/sonarr.
  • Separate boxes: type the host and the port in their own boxes, and the path (for example /sonarr) in the box called URL base or path.

Then paste that service's API key (for qBittorrent: username admin and the password from the table), and leave SSL or HTTPS switched off.

Helmarr (iPhone and iPad with iOS 26 or later):

  1. Open Helmarr and add a new service. Choose Sonarr.
  2. Address: http://<host>:<port>/sonarr, for example http://192.168.1.50:8585/sonarr. Paste the Sonarr API key.
  3. Repeat for Radarr (/radarr), Prowlarr (/prowlarr) and qBittorrent (/qbittorrent, username admin and the password from the table). Add Bazarr (/bazarr) too if you like.
  4. For away from home, use your server's Tailscale name as the host, for example http://casaos:8585/radarr. Helmarr can also keep two addresses for each service, one for home and one for away, and switch between them by itself.

CleanCut's Settings → Connection page has these steps with your own details filled in, under Step by step: Helmarr.

nzb360 (Android):

  1. Open nzb360's settings and add Sonarr: the address including the path (http://<host>:<port>/sonarr) and the Sonarr API key.
  2. Add Radarr, Prowlarr, Bazarr and qBittorrent the same way, each with its own path. qBittorrent uses username admin and the password from the table.
  3. For away from home, use the Tailscale name as the host. nzb360 can also switch between a home address and an away address by itself.

Use the Tailscale name everywhere if you'd rather set things up once: with Tailscale switched on, the same addresses work at home and away.

Please don't change the built-in apps' settings through a phone app (quality profiles, folders, download clients). CleanCut set those up and keeps them working; changes there can break its automatic setup. Adding, searching and checking on titles is exactly what phone apps are for.

Family requests with Seerr (optional)

CleanCut already has a request page for your kids (see At home above), and that's enough for most families. Seerr is a separate, free app where family members sign in and ask for movies and shows, and you approve them. It's for people who already use it or want more than CleanCut's kids' page. You install Seerr yourself: see docs.seerr.dev.

To connect Seerr to CleanCut:

  1. In CleanCut, switch on Allow phone apps and request services (Step 1 above).
  2. In Seerr, open Settings → Services and press Add Radarr Server. Fill it in like this:
    • Default Server: tick it. Seerr only sends requests to a server marked as default.
    • Server Name: any name you like, for example CleanCut Movies.
    • Hostname or IP Address: your server's IP address, for example 192.168.1.50.
    • Port: the port CleanCut shows (usually 8585).
    • Use SSL: leave it off.
    • API Key: the Radarr API key from CleanCut.
    • URL Base: /radarr.
  3. Press Test. When Seerr says the connection worked, its Quality Profile and Root Folder lists fill in (they stay empty until you test). Under Quality Profile, choose CleanCut. Under Root Folder, choose /data/media/movies. Then press Add Server.
  4. Press Add Sonarr Server and fill it in the same way: tick Default Server, use the Server Name CleanCut TV, the same host and port, Use SSL off, the Sonarr API key and the URL Base /sonarr. Press Test. Under Quality Profile, choose CleanCut. Under Root Folder, choose /data/media/tv. Then press Add Server.

Requests you approve in Seerr are cleaned like everything else. CleanCut's Settings → Connection page shows these steps with your own details filled in, under Step by step: Seerr (family requests).

Is this safe?

Yes. Here's why, in plain words.

  • No router changes, nothing opened to the internet. You never need to "open ports" or set up "port forwarding" on your router (that means making your server reachable by anyone on the internet). Tailscale doesn't need it, and we don't recommend it.
  • Only your own devices. Tailscale only links devices that are signed in to your account. Only add your own phones, tablets and computers, and don't share your Tailscale sign-in. If a phone is lost, remove it from your device list at login.tailscale.com/admin/machines.
  • Everything still needs its key or password. The dashboard needs your parent password. Each built-in app needs its API key, or the admin password for qBittorrent. Keep these private, like any password.
  • Phone app access is off until you switch it on, and you can switch it off again at any time with the same switch. While it's off, the built-in apps can't be reached from other devices.
  • It doesn't change how CleanCut downloads. If you use a VPN for downloading, it still carries all of it, and downloading stops if the VPN drops.

If something doesn't work

CleanCut won't open away from home

  1. Check that Tailscale is switched on in the app on your phone.
  2. Check that your phone and your server are signed in to the same Tailscale account, and that the server shows in the device list in the Tailscale app.
  3. Check the address: it starts with http:// and ends with :8585 (or your own port).
  4. Try the server's Tailscale address (the one that starts with 100.) instead of its name.
  5. Is the server switched on and awake? Tailscale can only reach it while it's running.

A phone app says "Phone app access is off"

The switch in Step 1 is off. Turn on Allow phone apps and request services in Settings → Connection, wait a few seconds, and try again.

A phone app can't connect

  1. Check the path is included (/sonarr, /radarr ...), the port is the one CleanCut shows, and SSL is off.
  2. Copy the API key again, making sure you copy all of it.
  3. For qBittorrent, the username is admin and the password is the one in CleanCut's table.
  4. Away from home, check Tailscale is switched on on your phone.

Still stuck? The help page has more under Using CleanCut away from home, and phone apps like Helmarr and nzb360. Inside CleanCut, the Help page has a Run check-up button that tests everything at once and links straight to the right fix.

CleanCut Suite 1.3.1 · by Harrelson Products and Services Install · From your phone · Help · Lost your key? · Refunds · License · Terms · Privacy CleanCut Suite is not affiliated with or endorsed by Plex Inc.