Topic
#tailscale
Loot, blog posts and adjacent themes connected to this topic. Follow the tag to keep it in your orbit.
2Shown loot
0Shown articles
8Linked neighbor tags
Topic paths
If you want to go deeper, the adjacent tags are the fastest way to compare and branch into related workflows.
Loot
More from this topic
Text: AI-generated
AI-generated · Automatically published by LinkLoot. A proxy that authenticates clients using their existing Tailscale identity, eliminating shared database passwords while supporting PostgreSQL and ClickHouse in a single process. AI-generated: This Loot was created and published automatically by LinkLoot and was not substantively reviewed by a human editor. What it does tailscale-database-gateway is a proxy that lets users connect to databases without managing individual credentials. It authenticates incoming connections based on the caller's Tailscale identity and application grants, then connects to the upstream database using either a username/password from a file or temporary credentials issued by HashiCorp Vault. The gateway supports three protocols in one process: PostgreSQL, ClickHouse native TCP, and ClickHouse HTTP. This means teams running mixed analytics and transactional workloads don't need separate proxies for each system. Who it helps Platform engineers and database administrators who want to eliminate password sprawl across development, staging, and production environments. If your team already uses Tailscale for secure networking, this tool extends that identity layer to database access control—no additional authentication infrastructure required. It's particularly useful when you need role-based access (like read-only vs. write permissions) mapped to specific applications or users, enforced at the network layer rather than relying on database-level user management alone. Getting started Deploy the published container image (ghcr.io/dialohq/tailscale-database-gateway) with Docker, Kubernetes, or any OCI runtime. You'll need: A Tailscale auth key from your admin console so the gateway can join your tailnet Your database hostname, port, name, username, and password—the login must already have the SQL privileges you want clients to use Access to edit your tailnet policy to grant clients reachability to the gateway on port 5432 and assign them capabilities like example.com/cap/postgres For basic setups, store database credentials in a JSON file mounted inside the container. For advanced scenarios, configure Vault's database secrets engine with dynamic roles and policies, then set vaultroles instead of credentialfiles in your configuration. Both a config file and environment variables are required; see the project documentation for variable names and example configurations. Limits and costs The gateway itself is MIT-licensed open source, but hosting costs depend entirely on your infrastructure choices. Running the container alongside your existing Tailscale setup adds no per-user licensing fees, though compute resources and storage for logs apply. Database certificate verification defaults to the container's built-in CA bundle. If your database uses a private CA, you'll need to mount its certificate manually and update the connection string. Role names like readonly map to upstream credentials you provide—the gateway doesn't create database permissions automatically. Ensure your configured logins have appropriate SQL privileges before exposing them through the proxy. Source links Official repository Project documentation MIT License
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
A practical self-hosting resource for exposing Docker apps inside a private Tailnet instead of opening router ports, reverse proxies, and public subdomains by default. What this is ScaleTail is a collection of ready-to-run Docker Compose stacks that attach common self-hosted apps to a Tailscale tailnet through a sidecar container. The useful idea is simple: make private tools reachable from your own devices without turning every dashboard, password vault, document archive, or admin panel into a public web service. Best use case Use this when you run services such as Vaultwarden, Paperless-ngx, Jellyfin, Immich, Pi-hole, AdGuard Home, Home Assistant, Open WebUI, Portainer, or Uptime Kuma and want remote access without a new router port, reverse-proxy rule, or public DNS entry for every app. Workflow Create a reusable Tailscale auth key in the Tailscale admin console. Pick the ScaleTail template matching your service. Review the Docker Compose file before running it, especially volumes, environment variables, and exposed ports. Bind the app container to the Tailscale sidecar network stack with the template's networkmode: service: pattern. Start the stack with Docker Compose and confirm the service appears in your Tailnet. Use Tailscale Serve for private Tailnet access. Only use Funnel when the service is intentionally public. Security notes ScaleTail reduces accidental public exposure, but it does not replace Docker hardening, backups, patching, or least-privilege access controls. Treat every template as code: inspect the image source, tags, volume mounts, environment variables, and update policy before production use. Keep admin panels, password managers, document stores, and local AI interfaces private unless you have a strong reason to expose them publicly. Do not confuse Tailscale Serve with Funnel: Serve is private to the Tailnet, while Funnel publishes a service to the public internet. Quick decision table Need Use ScaleTail? Caveat --- --- --- Private remote access to homelab apps Yes Requires Tailscale and Docker Compose Public webhook endpoint Maybe Funnel can be public; harden it carefully Full site publishing No Use a normal deployment and security model Multi-service homelab on one host Yes Still plan backups, updates, and separation Source check The Tarnkappe article explains the privacy angle, the Serve/Funnel distinction, and why ScaleTail fits self-hosted Docker services that should not be exposed publicly by default. The ScaleTail GitHub repository confirms that the project provides Docker Compose sidecar configurations for connecting self-hosted apps to a Tailnet. Tailscale's own Docker documentation provides the official baseline for running Tailscale with containers.
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
Blog
Related reads
No blog posts for #tailscale yet
There is no published article with this tag right now. Browse the blog for adjacent themes or follow the tag for future updates.