{{Service}} with Tailscale Integration

This project sets up a {{Service}} instance with Tailscale VPN integration using Docker Compose. It creates a secure, private network connection for your {{Service}} instance using Tailscale.

Prerequisites

• Docker and Docker Compose installed on your system
• A Tailscale account and auth key (get one from https://login.tailscale.com/admin/authkeys)
• Basic understanding of Docker and networking concepts

Project Structure

ts-{{service}}/
├── docker-compose.yml
├── tailscale/
│   ├── tailscale-data/     # Persistent Tailscale state
│   └── config/             # Tailscale configuration files
└── {{service}}/
    └── config/             # {{Service}} configuration files

Setup Instructions

1. Clone the Repository

   git clone https://gitea.example.com/org/ts-{{service}}
   cd ts-{{service}}
   

2. Create Required Directories

   mkdir -p tailscale/tailscale-data
   

3. Configure Tailscale

   • Make sure TS_AUTHKEY and TS_LOGIN_SERVER are set in your environment (or a local .env file) before running docker compose.
   • Optionally, update the file in tailscale/config/serve.json if you need specific Tailscale serve configurations
     • CAUTION: Changing "${TS_CERT_DOMAIN}:443": false to true will expose the service to the internet

4. Configure {{Service}}

   • See the documentation for configuration options

5. Start the Services

   docker compose up -d
   

6. Wait for Certificate to propagate [~2m]

7. Login

   • After starting the services your service should be available via tailnet at https://{{service}}.{{YOUR_TAILNET_DOMAIN}}.ts.net ie https://{{service}}.tail12345.ts.net/

Services

{{service}}-ts (Tailscale)

• Runs Tailscale VPN client
• Image: tailscale/tailscale:latest
• Container name: {{service}}-ts
• Hostname: {{service}}
• Requires NET_ADMIN and SYS_MODULE capabilities
• Persists state in ./tailscale/tailscale-data
• Uses configuration from ./tailscale/config

{{service}}

• Depends on {{service}}-ts service

Usage

• After starting the services your service should be available via tailnet at https://{{service}}.{{YOUR_TAILNET_DOMAIN}}.ts.net ie https://{{service}}.tail12345.ts.net/
• To manually get the Tailscale IP/hostname of your container:

  docker logs {{service}}-ts
  

  Look for the Tailscale IP address in the logs.

Optional Features

• Uncomment and adjust the ports mapping if you need direct access (without Tailscale):

  ports:
  - 3000:3000
  

• Stopping the Services

  docker compose down
  

Troubleshooting

• Check container logs:

  docker logs {{service}}-ts
  docker logs {{service}}
  

• Ensure your Tailscale auth key is valid and not expired
• Verify the configuration files have proper permissions
• Make sure required directories exist before starting

Notes

• The {{Service}} service uses the Tailscale service's network stack via network_mode: service:{{service}}-ts
• Direct port mapping is disabled by default as Tailscale handles the networking
• Services restart automatically unless explicitly stopped
• For more information:
  • Tailscale documentation: https://tailscale.com/kb/
  • {{Service}} documentation
  • {{Service}} repository
  • {{Service}} linuxserve.io

Tailscale Serve Configuration

This repo includes two serve configuration files:

• tailscale/config/serve.json — Default (recommended for Tailscale with MagicDNS + certs)
• tailscale/config/serve.headscale.json — For Headscale or Tailscale without certs (HTTP only)

How to use

Tailscale (default):

• No changes needed. The default serve.json will be used.

Headscale:

1. Copy serve.headscale.json over serve.json:

   cp tailscale/config/serve.headscale.json tailscale/config/serve.json
   

2. Update the hostname in serve.json to match your service.

After changing the serve config, restart the sidecar:

docker compose restart <service>-ts

Configuration

Environment Variables

Copy .env.example to .env and fill in your values:

cp .env.example .env

Tailscale Serve Configuration

This repo ships with two serve configuration options:

File	Use Case	Description
tailscale/config/serve.json	Tailscale (default)	Supports both HTTP and HTTPS when MagicDNS + certs are configured
tailscale/config/serve.headscale.json	Headscale / no certs	HTTP-only on port 80

To switch to Headscale mode:

cp tailscale/config/serve.headscale.json tailscale/config/serve.json
docker compose restart vikunja-ts

Update the hostname in serve.headscale.json to match your service.