GitHub

GitHub - almeidapaulopt/tsdproxy: Tailscale Docker Proxy

Tailscale Docker Proxy. Contribute to almeidapaulopt/tsdproxy development by creating an account on GitHub.

https://almeidapaulopt.github.io/tsdproxy/docs/getting-started/

##############

I focused on using the tailscale Funnel feature...

https://tailscale.com/kb/1223/funnel

This will focus on using the tailscale docker in conjunction with the tsdproxy docker

Standalone Compose file runs tailscale, tsdproxy and npm(Optional)

#version: "3.8"

services:

tailscale:

image: tailscale/tailscale

container_name: tailscale

network_mode: "host"

privileged: true

cap_add:

- NET_ADMIN

environment:

- TS_AUTHKEY=${TS_AUTHKEY}

#Get your auth key here: https://login.tailscale.com/admin/settings/keys

volumes:

- /dev/net/tun:/dev/net/tun

- /mnt/user/appdata/reverseproxy/tailscale/var-lib:/var/lib/tailscale

- /var/run/tailscale:/var/run/tailscale

restart: unless-stopped

tsdproxy:

image: ghcr.io/almeidapaulopt/tsdproxy:latest

container_name: tsdproxy

ports:

- "8080:8080"

volumes:

- /var/run/docker.sock:/var/run/docker.sock:ro

- /var/run/tailscale:/var/run/tailscale

- /mnt/user/appdata/reverseproxy/tsdproxy/data:/data

- /mnt/user/appdata/reverseproxy/config:/config

restart: unless-stopped

#Optional Revers Proxy for other setups...

# npm:

# image: jc21/nginx-proxy-manager:latest

# container_name: npm

# hostname: proxy

# networks:

# netproxy:

# ipv4_address: 172.22.0.4

# ports:

# - "127.0.0.1:8180:80"

# - "127.0.0.1:8443:443"

# - "8181:81"

# environment:

# - DISABLE_IPV6=true

# volumes:

# - /mnt/user/appdata/reverseproxy/npm/data:/data

# - /mnt/user/appdata/reverseproxy/npm/letsencrypt:/etc/letsencrypt

# restart: unless-stopped

networks:

netproxy:

driver: bridge

ipam:

config:

- subnet: 172.22.0.0/24

docker-compose.yml

Other example tsdproxy config:
example config I used... (Unraid at ip 192.168.2.254)

Example tsdproxy.yaml placed in the compose config folder

defaultProxyProvider: default

docker:

local:

host: unix:///var/run/docker.sock

targetHostname: 192.168.2.254

defaultProxyProvider: default

files: {}

tailscale:

providers:

default:

authKey: "tskey-auth-########" # Use the Same TS Auth KEY in the Compose! This is handled by the Tailscale container

controlUrl: https://controlplane.tailscale.com

dataDir: /data/

http:

hostname: 0.0.0.0

port: 8080

log:

level: info

json: false

proxyAccessLog: true

tsdproxy.yaml

so how does this work?...
(I've found it works better if the docker you want to share is in a docker bridge network...)

So how do i add a docker to tsdproxy?
the docker you want forward facing, you add this label
example for immich:

compose optons for other dockers

labels:

- tsdproxy.enable=true

- tsdproxy.name=immich

- tsdproxy.funnel=true

This will enable tsdproxy to forward the docker port, this will create a machine called immich.<yourtailscale>.ts.net and will enable the funnel feature
https://almeidapaulopt.github.io/tsdproxy/docs/docker/

AS example As, I also did one for plex example:

add lable to plex for tsdproxy to make a tailscalenet example

labels:

- tsdproxy.enable=true

- tsdproxy.name=plex

- tsdproxy.funnel=true

what does it look like then?

OMV being the Unraid host name that the tailscale docker added...

so now if i go to immich.<tailscalname>.ts.net
I hit my web UI

docker-compose.yml tsdproxy.yaml

Edited May 27, 20251 yr by bmartino1
Data-Typo

Small docker compose update... The above compose will work, but if docker compose down, and docker compose up. This may make duplicates machines in the tailscale admin interface, This is due to the tailscald not having a state file and keeping machine identity... A simple command file to the tailscale sidecar docker method... as the machine identity is not saved and is removed at compose down removal...

Simple fix though.. Add the tailscal state file:
command: tailscaled --state=/var/lib/tailscale/tailscaled.state

*add this under tailscale docker compose section...

With this options added. I had to remove the machines form the tails scale admin interface and when I composed up I only had immich and plex no omv (the urnaid host)

Updated example Fix tailscale state file

#version: "3.8"

services:

tailscale:

image: tailscale/tailscale

pull_policy: always

# Watch Tower Compose Update Docker

# labels:

# - "com.centurylinklabs.watchtower.enable=true"

container_name: tailscale

network_mode: "host"

privileged: true

cap_add:

- NET_ADMIN

environment:

- TS_AUTHKEY=${TS_AUTHKEY}

#Get your auth key here: https://login.tailscale.com/admin/settings/keys

volumes:

- /dev/net/tun:/dev/net/tun

- /mnt/user/appdata/reverseproxy/tailscale/var-lib:/var/lib/tailscale

- /var/run/tailscale:/var/run/tailscale

command: tailscaled --state=/var/lib/tailscale/tailscaled.state

restart: unless-stopped

tsdproxy:

image: ghcr.io/almeidapaulopt/tsdproxy:latest

pull_policy: always

# Watch Tower Compose Update Docker

# labels:

# - "com.centurylinklabs.watchtower.enable=true"

container_name: tsdproxy

ports:

- "8080:8080"

#If you have something else using port 8080 change to 60080:8080

volumes:

- /var/run/docker.sock:/var/run/docker.sock:ro

- /var/run/tailscale:/var/run/tailscale

- /mnt/user/appdata/reverseproxy/tsdproxy/data:/data

- /mnt/user/appdata/reverseproxy/config:/config

restart: unless-stopped

#Optional Reverse Proxy

# npm:

# image: jc21/nginx-proxy-manager:latest

# pull_policy: always

# Watch Tower Compose Update Docker

# labels:

# - "com.centurylinklabs.watchtower.enable=true"

# container_name: npm

# hostname: proxy

# networks:

# netproxy:

# ipv4_address: 172.42.0.4

# ports:

# - "127.0.0.1:8180:80"

# - "127.0.0.1:8443:443"

# - "8181:81"

# environment:

# - DISABLE_IPV6=true

# volumes:

# - /mnt/user/appdata/reverseproxy/npm/data:/data

# - /mnt/user/appdata/reverseproxy/npm/letsencrypt:/etc/letsencrypt

# restart: unless-stopped

#Network for npm docker bridge and tsdproxy

networks:

netproxy:

driver: bridge

ipam:

config:

- subnet: 172.42.0.0/24

Recommend fixing to not cause tail scale device duplication:

*I also recommend running watch tower as host setting labels to update compose dockers on unraid...

What the admin interface will look like after comand added:

docekr-compose.yml

Watchtower docker in compose

#version: "3.8"

services:

watchtower:

image: containrrr/watchtower

container_name: watchtower

restart: unless-stopped

network_mode: host

volumes:

- /var/run/docker.sock:/var/run/docker.sock

command: >

--schedule "0 1 10 * *"

--cleanup

--include-stopped

--label-enable

labels:

- "com.centurylinklabs.watchtower.enable=false"

Edited May 28, 20251 yr by bmartino1
Data - typo

This is known as a side car method

-l tsdproxy.enable=true -l tsdproxy.name=plex -l tsdproxy.funnel=true

or

--label tsdproxy.enable=true --label tsdproxy.name=plex --label tsdproxy.funnel=true \

and can be added to urnaid ca via extra parm:

Edited February 18Feb 18 by bmartino1