Tailscale, let's encrypt and github webhooks

[visiongeist]

Hi,
when I take down the dokploy UI to be reachable from public and only having access to it through tailscale, how do I make sure that github webhooks and also the ootb let's encrypt cert. assignment is still working?
thank you

[dosubot[bot]]

Hi @visiongeist! I'm Dosu and I'm helping the Dokploy team.

Both concerns come from the same root: Dokploy's ACME setup uses an HTTP-01 challenge — Traefik's letsencrypt resolver issues challenges on the web (port 80) entrypoint [1]. That means Let's Encrypt must reach http://your-domain/.well-known/acme-challenge/... from the public internet. If your server isn't publicly reachable on port 80, certificate issuance will fail [2].

Similarly, GitHub webhooks hit POST /api/deploy/github on your server's public URL [3], so GitHub's servers also need to reach your host.

The practical approach: Keep ports 80 and 443 publicly open at the firewall level, but restrict access to the Dokploy UI specifically via Tailscale or Traefik middleware. The Dokploy UI uses the Traefik router dokploy-router-app [4], so you can add authentication middleware (e.g., basicAuth, ipAllowList, or forwardAuth) to that router only, leaving the webhook path /api/deploy/github and ACME challenge paths accessible. Traefik supports per-router middleware, so you can be selective about what's protected.

Alternatives for Let's Encrypt if you can't open port 80:

• DNS-01 challenge — doesn't require any inbound connection. Traefik supports it via DNS provider plugins (Cloudflare, Route53, etc.), but you'd need to configure this manually in Traefik's static config since Dokploy doesn't expose a DNS-01 option in the UI [1].

Alternatives for GitHub webhooks if you can't expose the endpoint:

• Tailscale Funnel — if available on your Tailscale plan, it can expose specific paths publicly through Tailscale's relay infrastructure without opening your firewall directly (note: this is a Tailscale feature, not Dokploy-specific).
• A webhook relay/proxy (e.g., smee.io) that forwards events to your private endpoint — though this adds operational complexity.

In short, the simplest path is keeping 80/443 open while locking down the UI router specifically, rather than hiding the entire server behind Tailscale.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.