Monitor hosts over VPN with docker

[rallisf1]

When running Pulse on the host or with network_mode: host there is really no need for this, but in my case I wanted to run Pulse over Coolify, which doesn't support network_mode: host any more.

The following docker compose example is for accessing remote hosts over tailscale. The key configuration is network_mode: 'service:tailscale-client'. It supports:

1. headscale via TS_SERVER
2. local IPs via --accept-routes. Keep in mind that you need to advertise each remote route on your remote hosts' tailscale clients, and enable them through your tailscale/headscale dashboard.

You can use the Proxmox API with the tailnet IP (100.x.x.x), but you'll need to run the tailscale client directly on each host, which IMHO creates more problems than it solves (messes the local network routing).

On Proxmox servers I always run tailscale in an LXC and advertise the specific local IPs I want to be accessible.

Also note that when advertising multiple local networks, those networks must have a different subnet. If you have multiple locations with hosts you want to access you'll need to fix that. e.g.

• Location 1: 192.168.0.0/24
• Location 2: 192.168.1.0/24
• ...

services:
  pulse:
    image: 'rcourtman/pulse:latest'
    network_mode: 'service:tailscale-client'
    volumes:
      - 'pulse-data:/data'
    environment:
      - 'TZ=${TZ:-UTC}'
      - 'PULSE_AUTH_PASS=${PULSE_AUTH_PASS:?}'
      - 'PULSE_AUTH_USER=${PULSE_AUTH_USER:?}'
      - 'PULSE_PUBLIC_URL=${PULSE_PUBLIC_URL:?}'
    healthcheck:
      test:
        - CMD
        - wget
        - '--quiet'
        - '--tries=1'
        - '--spider'
        - 'http://localhost:7655/api/health'
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
  tailscale-client:
    image: 'tailscale/tailscale:latest'
    hostname: '${TS_HOSTNAME:-coolify-ts}'
    environment:
      - 'TS_HOSTNAME=${TS_HOSTNAME:-coolify-ts}'
      - 'TS_AUTHKEY=${TS_AUTHKEY:?}'
      - 'TS_STATE_DIR=${TS_STATE_DIR:-/var/lib/tailscale}'
      - 'TS_USERSPACE=${TS_USERSPACE:-false}'
      - 'TS_EXTRA_ARGS=--accept-routes --login-server=${TS_SERVER:-https://controlplane.tailscale.com}'
    volumes:
      - 'tailscale-client:/var/lib/tailscale'
    devices:
      - '/dev/net/tun:/dev/net/tun'
    cap_add:
      - net_admin
    healthcheck:
      test:
        - CMD-SHELL
        - "tailscale status --json | grep -q 'BackendState'"
      interval: 10s
      timeout: 5s
      retries: 5

P.S. Yes you can add a dependency for the tailscale-client service, but I also have many hosts that don't need tailscale (public VPS/Dedicated), and I wouldn't want all monitoring to stop if tailscale ever goes down.

P.S.2. Don't forget to map ports, or add a reverse proxy to the above config if you're not using Coolify.

[rcourtman]

Great write-up! Thanks for sharing this VPN/Tailscale setup for Docker users. This is a useful pattern for people running Pulse on Coolify or similar platforms that restrict network_mode.

I'll add this to our docs or examples for reference.