The "Missing or invalid configuration / config.json" screen is the web frontend telling you that the browser successfully loaded the SPA but then couldn't reach the URL that the SPA was told to talk to. That URL is whatever you set in OC_URL. So this isn't really three different bugs — it's one rule, applied three times:

Whatever you put in OC_URL is the only URL the browser is allowed to use. It must resolve, must be reachable, and (because https://) must present a valid certificate to the client — from every machine you want to log in from.

Your three cases all match that rule:

So the fix is to choose one hostname that every client (LAN, remote, Tailscale) can reach, set OC_URL to exactly that, and access OpenCloud at exactly that URL. A few options, in order of how clean they are:

Option A (recommended) — Tailscale MagicDNS name

If you have MagicDNS enabled in Tailscale, your host has a name like myhost.tail-xxxx.ts.net. That name resolves from any Tailscale-connected device, and you can also make it resolve on the LAN (split-DNS / Tailscale's own DNS).

OC_URL: https://myhost.tail-xxxx.ts.net:9200
PROXY_HTTP_ADDR: 0.0.0.0:9200
PROXY_TLS: true
OC_INSECURE: true     # while you're still on the auto-generated self-signed cert

You'll still get a browser warning until you put a real cert behind it (Tailscale can issue Let's Encrypt certs for *.ts.net names — see tailscale cert). Once you do that, drop OC_INSECURE.

Option B — Real domain + reverse proxy (best long-term)

Put OpenCloud behind a reverse proxy (Caddy, Traefik, NGINX Proxy Manager — you already mentioned NPM in your other thread) on something like cloud.my-domain.tld. Use split-horizon DNS so that name resolves to the LAN IP at home and the Tailscale IP (or public IP) elsewhere. Then:

OC_URL: https://cloud.my-domain.tld
PROXY_TLS: false                  # TLS terminates at the proxy
PROXY_HTTP_ADDR: 0.0.0.0:9200

This is the configuration the upstream compose file is built around, and it ends the certificate / hostname mismatch problems for good.

Option C — Plain LAN IP (quickest, limited)

If you only need it to work on the LAN for now, just keep:

OC_URL: https://192.168.x.y:9200

…and access it as https://192.168.x.y:9200. It will not work over Tailscale because the cert is for the IP and Tailscale gives you a different IP — and it won't work via homeassistant.local because the cert isn't for that name either.

Why homeassistant.local is a particularly bad choice

• .local is reserved for mDNS (RFC 6762). It only works on the same broadcast domain.
• Tailscale doesn't forward multicast, so .local names are unreachable over the VPN — by design.
• Self-signed certs generated by OpenCloud are bound to the address you configured, so even if the name did resolve, the browser would reject the cert.

If you want to keep using a friendly name on the LAN, give the host an A record in your router's DNS (e.g. cloud.lan → 192.168.x.y) instead of relying on mDNS, and put that name in OC_URL. But you still won't reach it over Tailscale unless that DNS is also served to Tailscale clients — which is why Option A or B are the ones that actually solve all three of your scenarios at once.

Quick checklist when you change OC_URL

1. Stop the stack, edit OC_URL, docker compose up -d.
2. From the client you're testing on:
   • nslookup <hostname> → must return an IP the client can reach.
   • curl -vk https://<hostname>:<port>/ → must connect (ignore the cert warning).
3. Open exactly that URL in the browser. Don't mix and match (e.g. opening the IP while OC_URL is the hostname will reproduce the config.json error every time).

Hope this clears up why it "works locally but not over Tailscale" — it's not a bug in the latest versions, it's that OC_URL has to match the URL the browser is actually using.

Notes for you before posting:

• If they say MagicDNS is off or they don't own a domain, Option C is the fallback — but make it clear it won't fix the Tailscale case.
• If they actually want help getting a Let's Encrypt cert via Tailscale or NPM, that's a follow-up; don't bundle it in or the answer gets too long.