Proxyt Tailscale Sidecar Configuration

compose.yml

# ---
# TS_CERT_DOMAIN=proxyt.yourtailnet.ts.net docker compose up
# ---

services:
  proxyt:
    image: ghcr.io/jaxxstorm/proxyt:latest
    container_name: proxyt
    # ports:
      # - 8080:8080
    restart: unless-stopped
    command: serve --domain $${TS_CERT_DOMAIN} --http-only --port 8080 --bind 0.0.0.0
    depends_on:
      - proxyt-sidecar
    network_mode: service:proxyt-sidecar

  proxyt-sidecar:
    image: tailscale/tailscale:latest
    container_name: proxyt-sidecar
    hostname: proxyt-sidecar
    environment:
      - TS_AUTHKEY=REPLACE_WITH_YOUR_OWN
      - TS_AUTH_ONCE=true
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_SERVE_CONFIG=/config/serve.json
      - TS_USERSPACE=false
    configs:
      - source: ts-serve
        target: /config/serve.json
    volumes:
      - proxyt-sidecar-state:/var/lib/tailscale
    cap_add:
      - NET_ADMIN
      - NET_RAW
    devices:
      - /dev/net/tun:/dev/net/tun
    restart: unless-stopped

configs:
  ts-serve:
    content: |
      {"TCP":{"443":{"HTTPS":true}},
      "Web":{"$${TS_CERT_DOMAIN}:443":
          {"Handlers":{"/":
          {"Proxy":"http://127.0.0.1:8080"}}}},
      "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":true}}

volumes:
  proxyt-sidecar-state:
    name: proxyt-sidecar-state