Tailscale and HTTPS

Tailscale and HTTPS

Tailscale provides private remote access and a trusted .ts.net HTTPS address without opening router ports.

Configuration

TAILSCALE_ENABLED=true
TAILSCALE_AUTHKEY=your-tailscale-auth-key
TAILSCALE_HOSTNAME=smart-drink-fridge
TAILSCALE_HTTPS=true

Then run:

./start.sh

The script:

1. Uses an existing host Tailscale installation when available
2. Otherwise starts the bundled Tailscale Compose profile
3. Waits for the connection
4. Enables Tailscale Serve on HTTPS port 443
5. Prints the private https://...ts.net address

Your phone must be signed in to the same tailnet.

Host permission error

If Tailscale reports Access denied, allow the current host user once:

sudo tailscale set --operator="$USER"
./start.sh

First HTTPS approval

Tailscale may print a one-time approval URL. Open it, approve HTTPS for the tailnet, and run ./start.sh again.

Verify

tailscale status
tailscale serve status

Once HTTPS works, follow PWA and mobile installation.

Existing Docker installation without start.sh

Some installations contain only docker-compose.yml and .env. Tailscale may be connected while HTTPS is still inactive. Check the Serve configuration:

docker exec smart-drink-fridge-tailscale tailscale serve status

If the result is No serve config, create the missing persistent proxy:

docker exec smart-drink-fridge-tailscale \
  tailscale serve --bg --yes --https=443 \
  http://127.0.0.1:5000

The command prints the correct private URL, for example:

https://smart-drink-fridge.example-tailnet.ts.net/

The Serve configuration is stored in the tailscale-state Docker volume and survives normal container recreation. It must be configured again if that volume is deleted.

The first HTTPS request may take several seconds while Tailscale obtains the certificate. Wait briefly and retry before treating the initial timeout as a failure.