Just thought I'd put together some detail on deploying Tailscale using Docker and Portainer. These bits-and-pieces are available elsewhere, but not together, so hopefully this will save someone a bit of time if you'd like to add Tailscale to an existing Docker install:
Here's my annotated recommended docker-compose, to use with Portainer-Stacks. Note that I'm not using a pre-made Auth Key. I started that way, but realized it was very easy to simply check the Portainer log for the tailscaled container once the stack is running. In that log you'll see the standard Auth link that you can use to authorize the container. This way you don't need to create a key in advance, or create a reusable key that introduces a security risk:
version: '3.9'
services:
tailscale:
image: tailscale/tailscale
container_name: tailscaled
cap_add:
- NET_ADMIN
- NET_RAW
environment:
# - TS_HOSTNAME=${TS_HOSTNAME} # Usually not necessary for your hostname to be the same name on the tailscale network
# - TS_AUTHKEY=${TS_AUTHKEY} # Generate auth keys here: https://login.tailscale.com/admin/settings/keys
# - TS_ROUTES=${TS_ROUTES} # Creates a subnet router for Tailscale. Use your subnet's CIDR in the form: 192.168.1.0/24
# - TS_ACCEPT_DNS=${TS_ACCEPT_DNS} # Set to false for Pi-hole Docker setups
- TS_SOCKET=${TS_SOCKET} # Specifying the /var/lib/tailscale/tailscaled.sock location allows use of standard Tailscale commands
- TS_EXTRA_ARGS=${TS_EXTRA_ARGS} # Add any other supported arguments in the docker commandline style: e.g. --advertise-exit-node
- TS_STATE_DIR=${TS_STATE_DIR} # Required to create a persistent container state that will survive reboots
volumes:
- /data:/var/lib # Creates a tailscale directory under /data for persistence
- /dev/net/tun:/dev/net/tun
network_mode: host
restart: unless-stoppedThese are the minimum environment variables you'll want to define in the Portainer-Environment section:
TS_SOCKET=/var/run/tailscale/tailscaled.sock
TS_EXTRA_ARGS=--accept-routes
TS_STATE_DIR=/var/lib/tailscaleWith these variables, you'll be able to exec into the container to run commands like "tailscale version" and "tailscale status". Your container will accept routes advertised by a designated node, and your setup (including authorization) will persist across reboots.
@kraizelburg les say your LAN is
192.168.1.0/24When you install tailscale on your nas, regardless of vendor nas, in your compose file you would set- TS_ROUTES=192.168.1.0/24.Now lets pretend your NAS LAN IP is 192.168.1.100.
Now if your in the coffee shop or on your phone or somewhere that is not the 192.168.1.0/24 network, and you have tailscale installed and --accept-routes set, than you can just go to http://192.168.1.100 as if it was on your network.
Under the hood the tailscale client on your device does a lookup on the tailscale network and sees that its allowed to forward 192.168.1.0/24 traffic to the instance installed on your nas.
That instance ALREADY has access to the nas, and simply redirects the traffic to http://192.168.1.100. This will work for any device on your LAN now. Unless the individual device is blocking traffic, etc.
This works flawlessly.