diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml index 4172a839..982bfcaf 100644 --- a/.github/workflows/linting.yml +++ b/.github/workflows/linting.yml @@ -29,9 +29,9 @@ jobs: - name: Clone this repo uses: actions/checkout@v6 - - name: Lint services + - name: Lint Markdown uses: rvben/rumdl@v0.2.41 with: - path: "services/" + path: "." config: ".markdownlint.yml" report-type: annotations diff --git a/README.md b/README.md index 7fdfbae9..07ab350f 100644 --- a/README.md +++ b/README.md @@ -51,11 +51,11 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose - [šŸŽ„ Media and Entertainment](#-media-and-entertainment) - [šŸ’¼ Productivity and Collaboration](#-productivity-and-collaboration) - [šŸ“Š Dashboards and Visualization](#-dashboards-and-visualization) - - [šŸ› ļø Development Tools](#ļø-development-tools) + - [šŸ› ļø Development Tools](#development-tools) - [šŸ“ˆ Monitoring and Analytics](#-monitoring-and-analytics) - [šŸ  Smart Home](#-smart-home) - [šŸ“± Utilities](#-utilities) - - [šŸ½ļø Food \& Wellness](#ļø-food--wellness) + - [šŸ½ļø Food \& Wellness](#food-wellness) - [Tailscale Information](#tailscale-information) - [Tailscale Funnel vs. Tailscale Serve](#tailscale-funnel-vs-tailscale-serve) - [Tailscale Funnel](#tailscale-funnel) @@ -99,6 +99,7 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | šŸ“° **FreshRSS** | A customizable feed reader with themes, extensions, and no separate database. | [Details](services/freshrss) | | šŸŽ„ **Frigate** | A self-hosted NVR with real-time AI object detection for IP cameras and local video monitoring. | [Details](services/frigate) | | šŸŽ® **Hytale** | A self-hosted Hytale game server. | [Details](services/hytale) | +| ā›ļø **Minecraft** | A self-hosted Minecraft Java Edition server for private Tailnet multiplayer. | [Details](services/minecraft) | | šŸ–¼ļø **Immich** | A self-hosted Google Photos alternative with face recognition and mobile sync. | [Details](services/immich) | | šŸ“ŗ **Jellyfin** | An open-source media system that puts you in control of managing and streaming your media. | [Details](services/jellyfin) | | šŸ“– **Kavita** | An open-source, self-hosted digital library for comics, manga, and ebooks. | [Details](services/kavita) | @@ -125,6 +126,7 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | šŸ’¼ Service | šŸ“ Description | šŸ”— Link | | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | | šŸ’° **Actual Budget** | A self-hosted personal finance and budgeting app focused on privacy and full data ownership. | [Details](services/actual-budget) | +| šŸ§  **AFFiNE** | A self-hosted workspace for documents, whiteboards, and databases. | [Details](services/affine) | | āš“ **Anchor** | An offline-first, self-hosted note-taking app with sync, attachments, sharing, and optional OIDC authentication. | [Details](services/anchor) | | šŸ“„ **BentoPDF** | A lightweight, self-hosted web app for viewing and managing PDF documents. | [Details](services/bentopdf) | | āœ‚ļø **ClipCascade** | A self-hosted clipboard manager for syncing and organizing clipboard history. | [Details](services/clipcascade) | @@ -150,6 +152,7 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | šŸ“„ **Mattermost** | A self-hosted collaborative workflow and communication tool. | [Details](services/mattermost) | | šŸ“ **Memos** | A lightweight, self-hosted note-taking and knowledge management platform for capturing ideas, daily notes, and personal knowledge. | [Details](services/memos) | | šŸ“ **Nanote** | A lightweight, self-hosted note-taking app with Markdown support. | [Details](services/nanote) | +| šŸ“‚ **NextExplorer** | A self-hosted file explorer for managing mounted directories. | [Details](services/next-explorer) | | šŸ¤– **Open WebUI** | A self-hosted AI platform with a ChatGPT-style interface for local and cloud-based models. | [Details](services/open-webui) | | šŸ”— **Pingvin Share** | **PROJECT ARCHIVED** A self-hosted file sharing platform. | [Details](services/pingvin-share) | | šŸ“… **Radicale** | A lightweight CalDAV and CardDAV server for self-hosted calendar, to-do, and contact sync. | [Details](services/radicale) | @@ -171,6 +174,7 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | šŸ  **Homepage** | A modern, highly customizable homepage for organizing links and monitoring services. | [Details](services/homepage) | | šŸ–¼ļø **NewWallpaperWhoDis** | A lightweight, self-hosted wallpaper management server and dynamic rotation engine built on flat-file architecture. | [Details](services/newwallpaperwhodis) | + ### šŸ› ļø Development Tools @@ -183,6 +187,7 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | šŸ³ **Dockhand** | A modern, lightweight Docker management UI for containers and Compose stacks. | [Details](services/dockhand) | | šŸ³ **Dockge** | A lightweight, self-hosted Docker Compose stack manager with a web UI. | [Details](services/dockge) | | šŸ–„ļø **Dozzle** | A real-time log viewer for Docker containers. | [Details](services/dozzle) | +| šŸ“ **Filebrowser** | A lightweight web file manager for a host directory. | [Details](services/filebrowser) | | šŸ” **FossFLOW** | A self-hosted tool to make beautiful isometric infrastructure diagrams. | [Details](services/fossflow) | | šŸ–„ļø **GitSave** | A self-hosted service to back up your GitHub repositories via a simple REST API and scheduled runs. | [Details](services/gitsave) | | šŸ–„ļø **Gokapi** | A lightweight self-hosted file sharing platform. | [Details](services/gokapi) | @@ -224,6 +229,8 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | šŸš— **Tracktor** | Self-hosted vehicle maintenance tracker. | [Details](services/tracktor) | | šŸ” **Transmute** | A self-hosted file conversion and transformation service for handling documents, media, and other format changes. | [Details](services/transmute) | + + ### šŸ½ļø Food & Wellness | šŸ„˜ Service | šŸ“ Description | šŸ”— Link | @@ -272,7 +279,7 @@ Made with [contrib.rocks](https://contrib.rocks). ## Contributing -See [CONTRIBUTING.md](/CONTRIBUTING.md) for guidance on adding services with the [template](/templates/service-template/) to keep Tailscale-sidecar setups consistent. +See [CONTRIBUTING.md](CONTRIBUTING.md) for guidance on adding services with the [template](templates/service-template/) to keep Tailscale-sidecar setups consistent. ## Star History diff --git a/services/actual-budget/.env b/services/actual-budget/.env index 87077102..d49fe2b0 100644 --- a/services/actual-budget/.env +++ b/services/actual-budget/.env @@ -11,7 +11,8 @@ SERVICEPORT=5006 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/actual-budget/README.md b/services/actual-budget/README.md index 535aaddf..93282d00 100644 --- a/services/actual-budget/README.md +++ b/services/actual-budget/README.md @@ -10,7 +10,7 @@ When paired with Tailscale, Actual Budget becomes accessible across your devices ## Configuration Overview -In this setup, the `tailscale-actual` service runs Tailscale, which manages secure networking for Actual Budget. The `actual` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures the application is only reachable over your Tailnet unless you explicitly expose ports. +In this setup, the `tailscale-actual` service runs Tailscale, which manages secure networking for Actual Budget. The `actual` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures the application is only reachable over your Tailnet unless you explicitly expose ports. ## Key Features diff --git a/services/adguardhome-sync/README.md b/services/adguardhome-sync/README.md index 1540bdf2..0a3c2f80 100644 --- a/services/adguardhome-sync/README.md +++ b/services/adguardhome-sync/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[AdGuardHome Sync](https://github.co ## Configuration Overview -In this setup, the `tailscale-adguardhome-sync` service runs Tailscale, which manages secure networking for the AdGuardHome Sync service. The `adguardhome-sync` container uses the Tailscale network stack via Dockerā€™s `network_mode: service:` configuration. This ensures that all sync communication is confined to your private Tailscale network, preventing exposure to the public internet. +In this setup, the `tailscale-adguardhome-sync` service runs Tailscale, which manages secure networking for the AdGuardHome Sync service. The `adguardhome-sync` container uses the Tailscale network stack via Dockerā€™s `network_mode: service:tailscale` configuration. This ensures that all sync communication is confined to your private Tailscale network, preventing exposure to the public internet. diff --git a/services/adguardhome/README.md b/services/adguardhome/README.md index e7fa44fa..b9f36dd3 100644 --- a/services/adguardhome/README.md +++ b/services/adguardhome/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [AdGuard Home](https://github.com/Adgu ## Configuration Overview -In this setup, the `tailscale-adguardhome` service runs Tailscale, which manages secure networking for the AdGuard Home service. The `adguardhome` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that AdGuard Home's DNS service is only accessible through the Tailscale network (or local as well, if preferred). +In this setup, the `tailscale-adguardhome` service runs Tailscale, which manages secure networking for the AdGuard Home service. The `adguardhome` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that AdGuard Home's DNS service is only accessible through the Tailscale network (or local as well, if preferred). ## Binding to your local host machine? Port 53 - DNSStubListener diff --git a/services/affine/.env b/services/affine/.env index 6e65bb1c..c14b19e5 100644 --- a/services/affine/.env +++ b/services/affine/.env @@ -11,7 +11,8 @@ SERVICEPORT=3010 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones @@ -30,4 +31,4 @@ AFFINE_SERVER_EXTERNAL_URL=https://affine..ts.net # database credentials DB_USERNAME=affine DB_PASSWORD=affine -DB_DATABASE=affine \ No newline at end of file +DB_DATABASE=affine diff --git a/services/affine/README.md b/services/affine/README.md index 27478ccf..3e066b19 100644 --- a/services/affine/README.md +++ b/services/affine/README.md @@ -20,7 +20,7 @@ AFFiNE is designed around modern knowledge work, blending structured content and ## Configuration Overview -In this setup, the `tailscale-affine` service runs Tailscale and handles secure networking for the stack. The `affine` service shares the Tailscale container's network namespace using Docker's `network_mode: service:` configuration. This means AFFiNE is reachable through your Tailnet without exposing it directly to the public internet. +In this setup, the `tailscale-affine` service runs Tailscale and handles secure networking for the stack. The `affine` service shares the Tailscale container's network namespace using Docker's `network_mode: service:tailscale` configuration. This means AFFiNE is reachable through your Tailnet without exposing it directly to the public internet. This approach provides a secure and simple way to self-host AFFiNE privately, whether for personal note-taking, team collaboration, or internal documentation. diff --git a/services/affine/compose.yml b/services/affine/compose.yml index e8f4a4dc..498ab8e2 100644 --- a/services/affine/compose.yml +++ b/services/affine/compose.yml @@ -66,7 +66,7 @@ services: env_file: - .env environment: - # Varibles are delared in .env file. + # Variables are declared in .env file. - REDIS_SERVER_HOST=redis - DATABASE_URL=postgresql://${DB_USERNAME}:${DB_PASSWORD}@postgres:5432/${postgres:-affine} - AFFINE_INDEXER_ENABLED=false @@ -84,7 +84,7 @@ services: env_file: - .env environment: - # Varibles are delared in .env file. + # Variables are declared in .env file. - REDIS_SERVER_HOST=redis - DATABASE_URL=postgresql://${DB_USERNAME}:${DB_PASSWORD}@postgres:5432/${postgres:-affine} - AFFINE_INDEXER_ENABLED=false @@ -111,7 +111,7 @@ services: volumes: - ./postgres:/var/lib/postgresql/data environment: - # Varibles are delared in .env file. + # Variables are declared in .env file. POSTGRES_USER: ${DB_USERNAME} POSTGRES_PASSWORD: ${DB_PASSWORD} POSTGRES_DB: ${postgres:-affine} diff --git a/services/anchor/.env b/services/anchor/.env index e95785fa..c8bc01e1 100644 --- a/services/anchor/.env +++ b/services/anchor/.env @@ -11,7 +11,8 @@ SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/anchor/README.md b/services/anchor/README.md index 70f49d43..d16c77b3 100644 --- a/services/anchor/README.md +++ b/services/anchor/README.md @@ -18,7 +18,7 @@ This Docker Compose configuration sets up [Anchor](https://github.com/ZhFahim/an ## Configuration Overview -In this setup, the `tailscale-anchor` service runs Tailscale and manages secure networking for Anchor. The `anchor` service shares that network stack via Docker's `network_mode: service:` configuration, which keeps the app private to your Tailnet unless you intentionally add host port mappings or funnel it through another public entrypoint. +In this setup, the `tailscale-anchor` service runs Tailscale and manages secure networking for Anchor. The `anchor` service shares that network stack via Docker's `network_mode: service:tailscale` configuration, which keeps the app private to your Tailnet unless you intentionally add host port mappings or funnel it through another public entrypoint. ## Upstream documentation diff --git a/services/arcane/.env b/services/arcane/.env index 89794c0b..8929be84 100644 --- a/services/arcane/.env +++ b/services/arcane/.env @@ -11,12 +11,14 @@ SERVICEPORT=3552 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables -TAILNET_NAME= # for example: tail-scale +TAILNET_NAME= +# for example: tail-scale #EXAMPLE_VAR="Environment varibale" diff --git a/services/arcane/README.md b/services/arcane/README.md index aa65e1f4..c086f358 100644 --- a/services/arcane/README.md +++ b/services/arcane/README.md @@ -22,7 +22,7 @@ This Docker Compose configuration sets up **Arcane** with a Tailscale sidecar co In this deployment, a **Tailscale sidecar container** (for example `tailscale-arcane`) runs the Tailscale client and joins your private Tailscale network. The main `arcane` service uses: ```plain -network_mode: service:tailscale-arcane +network_mode: service:tailscale ``` This configuration routes all traffic through the Tailscale interface, ensuring that the Arcane web UI and API are accessible **only via your Tailscale network**. This provides a simple and secure way to access your Docker management console from all trusted devices while preventing public access to container controls. diff --git a/services/artisttrackarr/.env b/services/artisttrackarr/.env index fa5d4d5f..ae57838c 100644 --- a/services/artisttrackarr/.env +++ b/services/artisttrackarr/.env @@ -11,7 +11,8 @@ SERVICEPORT=8080 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 @@ -30,4 +31,4 @@ POLL_INTERVAL=6h TRUST_PROXY=false # SPOTIFY_CLIENT_ID= # SPOTIFY_CLIENT_SECRET= -# SPOTIFY_MARKET=US \ No newline at end of file +# SPOTIFY_MARKET=US diff --git a/services/artisttrackarr/README.md b/services/artisttrackarr/README.md index 37594da4..890ec199 100644 --- a/services/artisttrackarr/README.md +++ b/services/artisttrackarr/README.md @@ -10,7 +10,7 @@ Pairing ArtistTrackarr with Tailscale provides private access to its web interfa ## Configuration Overview -In this setup, the `tailscale-artist-trackarr` service runs Tailscale and manages secure networking for ArtistTrackarr. The `artist-trackarr` service uses the Tailscale container's network stack through Docker's `network_mode: service:tailscale-artist-trackarr` configuration. +In this setup, the `tailscale-artist-trackarr` service runs Tailscale and manages secure networking for ArtistTrackarr. The `artist-trackarr` service uses the Tailscale container's network stack through Docker's `network_mode: service:tailscale` configuration. ArtistTrackarr listens on port `8080`. Because both containers share the same network namespace, Tailscale Serve can forward traffic directly to `http://127.0.0.1:8080`. diff --git a/services/artisttrackarr/compose.yaml b/services/artisttrackarr/compose.yaml index 472ab33f..f3cbc3c3 100644 --- a/services/artisttrackarr/compose.yaml +++ b/services/artisttrackarr/compose.yaml @@ -52,7 +52,7 @@ services: image: ${IMAGE_URL} # Image to be used network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale container_name: app-${SERVICE} # Name for local container management - environment: # Varibles are delared in .env file. + environment: # Variables are declared in .env file. PUID: 1000 PGI: 1000 TZ: ${TZ} @@ -95,4 +95,4 @@ secrets: encryption_key: environment: APP_ENCRYPTION_KEY session_secret: - environment: SESSION_SECRET \ No newline at end of file + environment: SESSION_SECRET diff --git a/services/audiobookshelf/README.md b/services/audiobookshelf/README.md index 677fc8d5..9ef2f84f 100644 --- a/services/audiobookshelf/README.md +++ b/services/audiobookshelf/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Audiobookshelf](https://github.com/ad ## Configuration Overview -In this setup, the `tailscale-audiobookshelf` service runs Tailscale, which manages secure networking for the Audiobookshelf service. The `audiobookshelf` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Audiobookshelfā€™s web interface and streaming capabilities are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your personal audiobook and podcast collection. +In this setup, the `tailscale-audiobookshelf` service runs Tailscale, which manages secure networking for the Audiobookshelf service. The `audiobookshelf` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Audiobookshelfā€™s web interface and streaming capabilities are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your personal audiobook and podcast collection. diff --git a/services/bazarr/README.md b/services/bazarr/README.md index 408c58d6..c966f62b 100644 --- a/services/bazarr/README.md +++ b/services/bazarr/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Bazarr](https://github.com/morpheus65 ## Configuration Overview -In this setup, the tailscale-bazarr service runs Tailscale, which manages secure networking for the Bazarr service. The bazarr service uses the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that Bazarrā€™s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted subtitle manager. +In this setup, the tailscale-bazarr service runs Tailscale, which manages secure networking for the Bazarr service. The bazarr service uses the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that Bazarrā€™s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted subtitle manager. diff --git a/services/bentopdf/README.md b/services/bentopdf/README.md index aaa8b27c..7db369cb 100644 --- a/services/bentopdf/README.md +++ b/services/bentopdf/README.md @@ -25,7 +25,9 @@ PDF files often contain sensitive personal or business information. Self-hosting In this deployment, a **Tailscale sidecar container** (for example `tailscale-bentopdf`) runs the Tailscale client and joins your private Tailscale network. The main `bentopdf` service uses: ```plain -network_mode: service:tailscale-bentopdf +network_mode: service:tailscale ``` This configuration routes all traffic through the Tailscale interface, ensuring that the BentoPDF web UI is accessible **only via your Tailscale network**. This provides a simple and secure way to access your PDF library from all trusted devices. + +BentoPDF listens on port `8080` inside the container. If you enable the optional host mapping, `SERVICEPORT` is the host port and maps to container port `8080`. diff --git a/services/bentopdf/compose.yaml b/services/bentopdf/compose.yaml index efea88d6..8daca760 100644 --- a/services/bentopdf/compose.yaml +++ b/services/bentopdf/compose.yaml @@ -35,7 +35,7 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:8080 # Binding the host port to BentoPDF's container port # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below #dns: # - ${DNS_SERVER} diff --git a/services/beszel-agent/README.md b/services/beszel-agent/README.md index 9913020f..3826dddb 100644 --- a/services/beszel-agent/README.md +++ b/services/beszel-agent/README.md @@ -8,4 +8,4 @@ The Beszel Agent is the client-side component that connects to the Hub to send a ## Configuration Overview -In this setup, the `tailscale` service runs Tailscale, which manages secure networking for the Beszel Agent service. The Agent service connects to the Tailscale network stack using Docker's `network_mode: service:` configuration. This setup guarantees that the Agent's communication channels are only accessible through the Tailscale network, providing an extra layer of security and privacy. +In this setup, the `tailscale` service runs Tailscale, which manages secure networking for the Beszel Agent service. The Agent service connects to the Tailscale network stack using Docker's `network_mode: service:tailscale` configuration. This setup guarantees that the Agent's communication channels are only accessible through the Tailscale network, providing an extra layer of security and privacy. diff --git a/services/beszel-hub/README.md b/services/beszel-hub/README.md index b2e4035c..a209b06f 100644 --- a/services/beszel-hub/README.md +++ b/services/beszel-hub/README.md @@ -8,4 +8,4 @@ The Beszel Hub is the core component responsible for routing messages between ag ## Configuration Overview -In this setup, the `tailscale` service runs Tailscale, which manages secure networking for the Beszel Hub service. The Hub service connects to the Tailscale network stack using Docker's `network_mode: service:` configuration. This setup guarantees that the Hub's communication channels are only accessible through the Tailscale network, providing an extra layer of security and privacy. +In this setup, the `tailscale` service runs Tailscale, which manages secure networking for the Beszel Hub service. The Hub service connects to the Tailscale network stack using Docker's `network_mode: service:tailscale` configuration. This setup guarantees that the Hub's communication channels are only accessible through the Tailscale network, providing an extra layer of security and privacy. diff --git a/services/booklore/.env b/services/booklore/.env index eba934a3..5e024870 100644 --- a/services/booklore/.env +++ b/services/booklore/.env @@ -7,24 +7,24 @@ SERVICE=booklore IMAGE_URL=ghcr.io/booklore-app/booklore # Network Configuration -SERVICEPORT=80 +SERVICEPORT=6060 DNS_SERVER=9.9.9.9 # Tailscale Configuration -TS_AUTHKEY= # Add your TS authkey +TS_AUTHKEY= +# Add your TS authkey # Time Zone setting for containers -TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones +TZ=Europe/Paris # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # MariaDB Credentials -MYSQL_ROOT_PASSWORD= # Use a strong password for the databases root user, should be different from MYSQL_PASSWORD +MYSQL_ROOT_PASSWORD= +# Use a strong password for the databases root user, should be different from MYSQL_PASSWORD MYSQL_DATABASE=booklore MYSQL_USER=booklore -MYSQL_PASSWORD= # Use a strong password; must match DATABASE_PASSWORD defined in the booklore container +MYSQL_PASSWORD= +# Use a strong password; must match DATABASE_PASSWORD defined in the booklore container -# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List -TZ=Europe/Paris - #EXAMPLE_VAR="Environment varibale" diff --git a/services/booklore/README.md b/services/booklore/README.md index 4ff1a917..b2c39176 100644 --- a/services/booklore/README.md +++ b/services/booklore/README.md @@ -8,4 +8,6 @@ This Docker Compose configuration sets up [BookLore](https://github.com/booklore ## Configuration Overview -In this setup, the `tailscale-booklore` service runs Tailscale, which manages secure networking for the BookLore service. The `booklore` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that BookLoreā€™s web interface are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy. +In this setup, the `tailscale-booklore` service runs Tailscale, which manages secure networking for the BookLore service. The `booklore` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that BookLoreā€™s web interface are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy. + +BookLore listens on port `6060`. Set `SERVICEPORT` to `6060` if you enable the optional host port mapping. diff --git a/services/caddy/.env b/services/caddy/.env index 77b5b6fc..494f6108 100644 --- a/services/caddy/.env +++ b/services/caddy/.env @@ -3,7 +3,7 @@ #COMPOSE_PROJECT_NAME= # Optional: only use when running multiple deployments on the same infrastructure. # Service Configuration -SERVICE=caddy # If this is changed please set docker-compose.yml services:caddy_proxy:healthcheck $SERVICE to the string caddy. Also update the Caddyfile FQDN. +SERVICE=caddy # If this changes, update the Caddyfile hostname. IMAGE_URL=caddy:latest # Network Configuration diff --git a/services/caddy/README.md b/services/caddy/README.md index c57dac9e..2dcf31bb 100644 --- a/services/caddy/README.md +++ b/services/caddy/README.md @@ -8,14 +8,16 @@ This Docker Compose configuration sets up [Caddy](https://github.com/caddyserver ## Configuration Overview -In this setup, the `tailscale-caddy` service runs Tailscale, which manages secure networking for the Caddy service. The `caddy_proxy` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Caddyā€™s dashboard and routing functionalities are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of privacy and security to your network architecture. +In this setup, the `tailscale-caddy` service runs Tailscale, which manages secure networking for Caddy. The `application` service uses Docker's `network_mode: service:tailscale` configuration. This keeps Caddy's dashboard and routes on your Tailnet unless you publish a host port. To get this working: - Update the FQDN in `Caddyfile` to match your `${SERVICE}.MagicDNSname.ts.net`. - Update the TS_AUTHKEY in the .env file to your Tailscale key. -If you change the `SERVICE=caddy` line in the .env file, the hostname of the FQDN in the Caddyfile must be updated as well. Additionally please replace $SERVICE in compose.yaml services:caddy_proxy:healthcheck with the string caddy. +If you change `SERVICE` in `.env`, update the hostname in `Caddyfile` as well. The healthcheck checks the `caddy` process regardless of the hostname. + +Both containers mount the socket directory, so Caddy can use the replacement socket after Tailscale restarts. The example `compose.yaml` uses a simple webserver for testing purposes. diff --git a/services/caddy/compose.yaml b/services/caddy/compose.yaml index 4cc90251..f2a2849e 100644 --- a/services/caddy/compose.yaml +++ b/services/caddy/compose.yaml @@ -18,7 +18,7 @@ services: volumes: - ./config:/config # Config folder used to store Tailscale files - you may need to change the path - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path - #- ./tailscale/tmp:/tmp # Share the tmp folder with the tailscale socket for TLS. Remove # if required. + - ./tailscale/tmp:/tmp # Share the tmp folder with the tailscale socket for TLS. devices: - /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work cap_add: @@ -46,16 +46,16 @@ services: - PGID=1000 - TZ=${TZ} volumes: - - $PWD/Caddyfile:/etc/caddy/Caddyfile - - $PWD/site:/srv - - $PWD/caddy_data:/data - - $PWD/caddy_config:/config - - $PWD/tailscale/tmp/tailscaled.sock:/var/run/tailscale/tailscaled.sock # mount the socket at the right place. Comment out if not required. + - ./Caddyfile:/etc/caddy/Caddyfile + - ./site:/srv + - ./caddy_data:/data + - ./caddy_config:/config + - ./tailscale/tmp:/var/run/tailscale # Share the directory so socket replacement survives Tailscale restarts. depends_on: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "pgrep", "-x", "caddy"] # The process name is independent of the Tailnet hostname. interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/changedetection/README.md b/services/changedetection/README.md index 3f6b9e11..c5a692fd 100644 --- a/services/changedetection/README.md +++ b/services/changedetection/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [ChangeDetection.io](https://github.co ## Configuration Overview -In this setup, the `tailscale-changedetection` service runs Tailscale, which manages secure networking for the ChangeDetection.io service. The `changedetection` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that ChangeDetection.ioā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy to your website monitoring setup. +In this setup, the `tailscale-changedetection` service runs Tailscale, which manages secure networking for the ChangeDetection.io service. The `changedetection` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that ChangeDetection.ioā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy to your website monitoring setup. diff --git a/services/clipcascade/README.md b/services/clipcascade/README.md index faea6370..38bf28d8 100644 --- a/services/clipcascade/README.md +++ b/services/clipcascade/README.md @@ -15,4 +15,4 @@ This Docker Compose configuration sets up [ClipCascade](https://github.com/Sathv ## Configuration Overview -In this setup, the `tailscale-clipcascade` service runs Tailscale, which manages secure networking for the ClipCascade service. The `clipcascade` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that ClipCascadeā€™s web interface and functionality are only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for managing your clipboard history. +In this setup, the `tailscale-clipcascade` service runs Tailscale, which manages secure networking for the ClipCascade service. The `clipcascade` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that ClipCascadeā€™s web interface and functionality are only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for managing your clipboard history. diff --git a/services/coder/README.md b/services/coder/README.md index d35ac6bc..219fee94 100644 --- a/services/coder/README.md +++ b/services/coder/README.md @@ -17,4 +17,4 @@ This Docker Compose configuration sets up [**Coder**](https://github.com/coder/c ## Configuration Overview -In this deployment, the `tailscale-coder` service runs the Tailscale client to establish a secure private network. The `coder` container uses `network_mode: service:tailscale-coder` to route all traffic through the Tailscale interface. This ensures that your development environments, admin UI, and web IDEs are only accessible via Tailscale, preventing public exposure. +In this deployment, the `tailscale-coder` service runs the Tailscale client to establish a secure private network. The `coder` container uses `network_mode: service:tailscale` to route all traffic through the Tailscale interface. This ensures that your development environments, admin UI, and web IDEs are only accessible via Tailscale, preventing public exposure. diff --git a/services/configarr/README.md b/services/configarr/README.md index bda68f1b..163980f6 100644 --- a/services/configarr/README.md +++ b/services/configarr/README.md @@ -31,7 +31,7 @@ This is especially useful for homelabs, shared servers, and environments where c In this deployment, a **Tailscale sidecar container** (for example, `tailscale-configarr`) runs the Tailscale client and joins your private Tailscale network. The Configarr service uses: ```plain -network_mode: service:tailscale-configarr +network_mode: service:tailscale ``` This setup ensures that **all Configarr network traffic flows exclusively through the Tailscale interface**, allowing it to securely communicate with Radarr and Sonarr instances that are also connected via Tailscale. No ports need to be exposed, and the service remains completely inaccessible from the public Internet. diff --git a/services/configarr/compose.yaml b/services/configarr/compose.yaml index a599c813..f5ba31bc 100644 --- a/services/configarr/compose.yaml +++ b/services/configarr/compose.yaml @@ -42,7 +42,7 @@ services: - TZ=${TZ} volumes: - ./${SERVICE}-data/config:/app/config - - ${PWD}/${SERVICE}-data/dockerrepos:/app/repos + - ./${SERVICE}-data/dockerrepos:/app/repos depends_on: tailscale: condition: service_healthy diff --git a/services/convertx/README.md b/services/convertx/README.md index 7e4f5e35..8d10844d 100644 --- a/services/convertx/README.md +++ b/services/convertx/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [ConvertX](https://github.com/C4illin/ ## Configuration Overview -In this setup, the `tailscale-convertx` service runs Tailscale, which manages secure networking for the ConvertX service. The `convertx` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that ConvertXā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an additional layer of security and privacy for your self-hosted media conversion workflow. +In this setup, the `tailscale-convertx` service runs Tailscale, which manages secure networking for the ConvertX service. The `convertx` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that ConvertXā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an additional layer of security and privacy for your self-hosted media conversion workflow. diff --git a/services/copyparty/README.md b/services/copyparty/README.md index c86205a2..0a6a22b9 100644 --- a/services/copyparty/README.md +++ b/services/copyparty/README.md @@ -22,4 +22,6 @@ With Tailscale in place, all of these features are securely tunneled through you ## Configuration Overview -In this setup, the `tailscale-copyparty` service runs Tailscale, which handles the secure networking layer. The `copyparty` service uses Dockerā€™s `network_mode: service:` setting to share the network stack of the Tailscale container. This means the Copyparty web interface and all file sharing functionality are only accessible via the Tailscale network (or locally if preferred), adding a strong privacy layer to your self-hosted file server. +In this setup, the `tailscale-copyparty` service runs Tailscale, which handles the secure networking layer. The `copyparty` service uses Dockerā€™s `network_mode: service:tailscale` setting to share the network stack of the Tailscale container. This means the Copyparty web interface and all file sharing functionality are only accessible via the Tailscale network (or locally if preferred), adding a strong privacy layer to your self-hosted file server. + +Before starting the stack, replace `/path/to/your/fileshare/top/folder` in `compose.yaml` with an absolute host directory for the files Copyparty should serve. diff --git a/services/cyberchef/README.md b/services/cyberchef/README.md index 3b335c68..327279ff 100644 --- a/services/cyberchef/README.md +++ b/services/cyberchef/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [CyberChef](https://github.com/gchq/Cy ## Configuration Overview -In this setup, the `tailscale-cyberchef` service runs Tailscale, which manages secure networking for the CyberChef service. The `cyberchef` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that CyberChefā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted data analysis tool. +In this setup, the `tailscale-cyberchef` service runs Tailscale, which manages secure networking for the CyberChef service. The `cyberchef` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that CyberChefā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted data analysis tool. diff --git a/services/ddns-updater/README.md b/services/ddns-updater/README.md index 94777442..6fed8414 100644 --- a/services/ddns-updater/README.md +++ b/services/ddns-updater/README.md @@ -15,4 +15,4 @@ By combining DDNS Updater with Tailscale, you can securely manage your dynamic D ## Configuration Overview -In this setup, the `tailscale-ddns-updater` service runs Tailscale, providing a secure networking layer for the DDNS Updater service. The `ddns-updater` service utilizes Docker's `network_mode: service:` configuration to route all traffic through the Tailscale network. This setup ensures that the DDNS Updater's web interface and API are only accessible within your private Tailnet, adding an extra layer of security to your DNS management. +In this setup, the `tailscale-ddns-updater` service runs Tailscale, providing a secure networking layer for the DDNS Updater service. The `ddns-updater` service utilizes Docker's `network_mode: service:tailscale` configuration to route all traffic through the Tailscale network. This setup ensures that the DDNS Updater's web interface and API are only accessible within your private Tailnet, adding an extra layer of security to your DNS management. diff --git a/services/dockge/.env b/services/dockge/.env index f07918af..13228942 100644 --- a/services/dockge/.env +++ b/services/dockge/.env @@ -7,14 +7,17 @@ SERVICE=dockge # Service name (e.g., adguard). Used as hostname in Tailscale and IMAGE_URL=louislam/dockge:1 # Docker image URL from container registry (e.g., adguard/adguard-home). # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables -STACKS_DIR= # Absolute path on host to store stack files. Must be bind mounted to the same path in compose.yaml. +STACKS_DIR=/opt/stacks +# Absolute path on host to store stack files. The host and container paths must match. # For example, create a folder in your docker compose folder with the name stacks (mkdir stacks) and use /path/to/docker-compose-container-folder/stacks. PUID=1000 # Set the stack file/dir ownership to this user -PGID=1000 # Set the stack file/dir ownership to this group \ No newline at end of file +PGID=1000 # Set the stack file/dir ownership to this group diff --git a/services/dockge/README.md b/services/dockge/README.md index 9fae38da..54fccc67 100644 --- a/services/dockge/README.md +++ b/services/dockge/README.md @@ -20,4 +20,4 @@ It is especially well-suited for homelabs, self-hosted environments, and DevOps ## Important Notice -Make sure to populate the `STACKS_DIR=` variable in the `.env` before first startup. +Set `STACKS_DIR` in `.env` to an absolute host path. The Compose file mounts that path at the same path inside the container. The sample uses `/opt/stacks`. diff --git a/services/dockge/compose.yaml b/services/dockge/compose.yaml index 7d21c9b3..24a32941 100644 --- a/services/dockge/compose.yaml +++ b/services/dockge/compose.yaml @@ -53,15 +53,15 @@ services: network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - # Varibles are delared in .env file. + # Variables are declared in .env file. - DOCKGE_STACKS_DIR=${STACKS_DIR} # Tell Dockge where your stacks directory is - PUID=${PUID} # Set the stack file/dir ownership to this user - PGID=${PGID} # Set the stack file/dir ownership to this group volumes: - ./${SERVICE}-data/app/config:/app/data - /var/run/docker.sock:/var/run/docker.sock - - ${STACKS_DIR}:/stacks + - ${STACKS_DIR}:${STACKS_DIR} depends_on: tailscale: condition: service_healthy - restart: always \ No newline at end of file + restart: always diff --git a/services/dockhand/.env b/services/dockhand/.env index 74a7ec0a..d8a71bf3 100644 --- a/services/dockhand/.env +++ b/services/dockhand/.env @@ -11,7 +11,8 @@ SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/dockhand/README.md b/services/dockhand/README.md index 5f764ec4..a6c63d94 100644 --- a/services/dockhand/README.md +++ b/services/dockhand/README.md @@ -30,7 +30,7 @@ Self-hosting Dockhand ensures that you maintain full ownership and operational c In this deployment, a Tailscale sidecar container (for example `tailscale-dockhand`) runs the Tailscale client and joins your private Tailscale network. The main `dockhand` service uses: ```plain -network_mode: service:tailscale-dockhand +network_mode: service:tailscale ``` This configuration routes all inbound and outbound traffic through the Tailscale interface, ensuring that the Dockhand web interface and Docker API interactions are accessible only via your Tailscale network. diff --git a/services/dockhand/compose.yaml b/services/dockhand/compose.yaml index 2b4e9780..29c716e2 100644 --- a/services/dockhand/compose.yaml +++ b/services/dockhand/compose.yaml @@ -61,7 +61,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "curl", "-fsS", "http://127.0.0.1:41234/healthz"] # Check if ${SERVICE} is responding + test: ["CMD", "curl", "-fsS", "http://127.0.0.1:3000/"] # Check if ${SERVICE} is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/docmost/README.md b/services/docmost/README.md index 6a0685a7..2a017983 100644 --- a/services/docmost/README.md +++ b/services/docmost/README.md @@ -19,4 +19,4 @@ This Docker Compose configuration sets up [**Docmost**](https://github.com/docmo ## Configuration Overview -In this configuration, the `tailscale-docmost` service runs the Tailscale client to secure network traffic. The `docmost` service uses `network_mode: service:tailscale-docmost`, ensuring all requests are routed through the Tailscale interface. This safeguards your documentation from public exposure, making it accessible only within your private mesh. +In this configuration, the `tailscale-docmost` service runs the Tailscale client to secure network traffic. The `docmost` service uses `network_mode: service:tailscale`, ensuring all requests are routed through the Tailscale interface. This safeguards your documentation from public exposure, making it accessible only within your private mesh. diff --git a/services/donetick/README.md b/services/donetick/README.md index f584d2e0..a6d573ae 100644 --- a/services/donetick/README.md +++ b/services/donetick/README.md @@ -1,19 +1,19 @@ -# Donetick with Tailscale Sidecar Configuration +# Donetick with Tailscale Sidecar Configuration This Docker Compose configuration sets up **[Donetick](https://github.com/donetick/donetick)** with Tailscale as a sidecar container to securely manage and access your self-hosted task management system over a private Tailscale network. By integrating Tailscale, you can ensure that your Donetick instance remains private and accessible only to authorized devices within your Tailscale network. -## Donetick +## Donetick [Donetick](https://github.com/donetick/donetick) is a **self-hosted task and checklist manager** designed for simplicity and efficiency. It helps users stay organized with structured to-do lists and task tracking while ensuring full control over their data. With Donetick, you can create tasks, set deadlines, and track progress without relying on third-party services. By integrating Tailscale, you can further secure your Donetick instance by restricting access to only authorized devices within your private network. -## Key Features +## Key Features -- **Task & Checklist Management** ā€“ Organize and track tasks efficiently. -- **Collaborative Workflows** ā€“ Share tasks and checklists with team members. -- **Self-Hosted Privacy** ā€“ Keep full control over your task management data. -- **Minimalist & Lightweight** ā€“ A simple, distraction-free interface for productivity. -- **Secure Access with Tailscale** ā€“ Restrict access to only authorized devices within your private network. +- **Task & Checklist Management** ā€“ Organize and track tasks efficiently. +- **Collaborative Workflows** ā€“ Share tasks and checklists with team members. +- **Self-Hosted Privacy** ā€“ Keep full control over your task management data. +- **Minimalist & Lightweight** ā€“ A simple, distraction-free interface for productivity. +- **Secure Access with Tailscale** ā€“ Restrict access to only authorized devices within your private network. -## Configuration Overview +## Configuration Overview -In this setup, the `tailscale-donetick` service runs Tailscale, which manages secure networking for the Donetick service. The `donetick` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Donetickā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing tasks and checklists. +In this setup, the `tailscale-donetick` service runs Tailscale, which manages secure networking for the Donetick service. The `donetick` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Donetickā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing tasks and checklists. diff --git a/services/dozzle/README.md b/services/dozzle/README.md index 771cbcc7..b1034951 100644 --- a/services/dozzle/README.md +++ b/services/dozzle/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Dozzle](https://github.com/amir20/doz ## Configuration Overview -In this setup, the `tailscale-dozzle` service runs Tailscale, which manages secure networking for the Dozzle service. The `dozzle` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Dozzleā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted log viewer. +In this setup, the `tailscale-dozzle` service runs Tailscale, which manages secure networking for the Dozzle service. The `dozzle` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Dozzleā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted log viewer. diff --git a/services/dumbdo/README.md b/services/dumbdo/README.md index e196a05a..2cfc595f 100644 --- a/services/dumbdo/README.md +++ b/services/dumbdo/README.md @@ -1,18 +1,18 @@ -# DumbDo with Tailscale Sidecar Configuration +# DumbDo with Tailscale Sidecar Configuration This Docker Compose configuration sets up [DumbDo](https://github.com/DumbWareio/DumbDo) with Tailscale as a sidecar container to securely manage and access your lightweight task manager over a private Tailscale network. By integrating Tailscale, you can ensure that your DumbDo instance remains private and accessible only to authorized devices within your Tailscale network. -## DumbDo +## DumbDo [DumbDo](https://github.com/DumbWareio/DumbDo) is a self-hosted, minimalistic task management tool designed to provide a distraction-free experience for managing to-do lists and tasks. With its simple interface and lightweight nature, DumbDo allows users to focus on productivity without unnecessary complexity. By integrating Tailscale, you can keep your task manager secure and accessible only within your private network. -## Key Features +## Key Features -- **Minimalist Task Management** ā€“ A straightforward approach to to-do lists without unnecessary complexity. -- **Self-Hosted** ā€“ Maintain full control over your data with a locally hosted instance. -- **Lightweight & Fast** ā€“ Designed for speed and efficiency without bloated features. -- **Secure Integration** ā€“ Pair with Tailscale to restrict access to authorized devices only. +- **Minimalist Task Management** ā€“ A straightforward approach to to-do lists without unnecessary complexity. +- **Self-Hosted** ā€“ Maintain full control over your data with a locally hosted instance. +- **Lightweight & Fast** ā€“ Designed for speed and efficiency without bloated features. +- **Secure Integration** ā€“ Pair with Tailscale to restrict access to authorized devices only. -## Configuration Overview +## Configuration Overview -In this setup, the `tailscale-dumbdo` service runs Tailscale, which manages secure networking for the DumbDo service. The `dumbdo` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that DumbDoā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for your task management system. +In this setup, the `tailscale-dumbdo` service runs Tailscale, which manages secure networking for the DumbDo service. The `dumbdo` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that DumbDoā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for your task management system. diff --git a/services/eigenfocus/README.md b/services/eigenfocus/README.md index c561528c..60ebbbc5 100644 --- a/services/eigenfocus/README.md +++ b/services/eigenfocus/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[Eigenfocus](https://github.com/Eige ## Configuration Overview -In this setup, the `tailscale-eigenfocus` service runs Tailscale, which manages secure networking for the Eigenfocus service. The `eigenfocus` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Eigenfocusā€™ web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing tasks and projects. +In this setup, the `tailscale-eigenfocus` service runs Tailscale, which manages secure networking for the Eigenfocus service. The `eigenfocus` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Eigenfocusā€™ web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing tasks and projects. diff --git a/services/espocrm/.env b/services/espocrm/.env index 18ad0d94..b931fc23 100644 --- a/services/espocrm/.env +++ b/services/espocrm/.env @@ -7,11 +7,13 @@ SERVICE=espocrm # Service name (e.g., adguard). Used as hostname in Tailscale an IMAGE_URL=espocrm/espocrm # Docker image URL from container registry (e.g., adguard/adguard-home). # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 diff --git a/services/espocrm/README.md b/services/espocrm/README.md index bd270096..2d30de33 100644 --- a/services/espocrm/README.md +++ b/services/espocrm/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [EspoCRM](https://www.espocrm.com/) wi ## Configuration Overview -In this setup, the `tailscale-EspoCRM` service runs Tailscale, which manages secure networking for EspoCRM. The `EspoCRM` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. +In this setup, the `tailscale-EspoCRM` service runs Tailscale, which manages secure networking for EspoCRM. The `EspoCRM` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. ## What to document for users diff --git a/services/excalidraw/README.md b/services/excalidraw/README.md index 7e8bee13..69063be9 100644 --- a/services/excalidraw/README.md +++ b/services/excalidraw/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Excalidraw](https://github.com/excali ## Configuration Overview -In this setup, the `tailscale-excalidraw` service runs Tailscale, which manages secure networking for the Excalidraw service. The `excalidraw` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This design ensures that Excalidraw's collaboration and editing features are only accessible through the Tailscale network (or locally, if preferred), providing enhanced security and privacy for your self-hosted Excalidraw instance. +In this setup, the `tailscale-excalidraw` service runs Tailscale, which manages secure networking for the Excalidraw service. The `excalidraw` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This design ensures that Excalidraw's collaboration and editing features are only accessible through the Tailscale network (or locally, if preferred), providing enhanced security and privacy for your self-hosted Excalidraw instance. diff --git a/services/filebrowser/.env b/services/filebrowser/.env index fd58305c..a6425982 100644 --- a/services/filebrowser/.env +++ b/services/filebrowser/.env @@ -11,7 +11,8 @@ SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/flaresolverr/README.md b/services/flaresolverr/README.md index cfa40be0..d5e7216b 100644 --- a/services/flaresolverr/README.md +++ b/services/flaresolverr/README.md @@ -8,4 +8,4 @@ FlareSolverr is an open-source proxy server to bypass Cloudflare and other anti- ## Configuration Overview -In this setup, the tailscale-flaresolverr service runs Tailscale, which manages secure networking for the FlareSolverr service. The flaresolverr service uses the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that FlareSolverrā€™s API (typically running on port 8191) is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted anti-bot proxy. +In this setup, the tailscale-flaresolverr service runs Tailscale, which manages secure networking for the FlareSolverr service. The flaresolverr service uses the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that FlareSolverrā€™s API (typically running on port 8191) is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted anti-bot proxy. diff --git a/services/flatnotes/.env b/services/flatnotes/.env index 6e2f3ee9..edb0c494 100644 --- a/services/flatnotes/.env +++ b/services/flatnotes/.env @@ -19,9 +19,6 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim # Optional Service variables # PUID=1000 -#Time Zone for container -TZ=Europe/Amsterdam - # Flatnotes environment FLATNOTES_AUTH_TYPE=password FLATNOTES_USERNAME=user diff --git a/services/flatnotes/README.md b/services/flatnotes/README.md index 447685b3..82c12647 100644 --- a/services/flatnotes/README.md +++ b/services/flatnotes/README.md @@ -1,19 +1,19 @@ -# Flatnotes with Tailscale Sidecar Configuration +# Flatnotes with Tailscale Sidecar Configuration This Docker Compose configuration sets up **[Flatnotes](https://github.com/dullage/flatnotes)** with Tailscale as a sidecar container to securely manage and access your self-hosted note-taking application over a private Tailscale network. By integrating Tailscale, you can ensure that your Flatnotes instance remains private and accessible only to authorized devices within your Tailscale network. -## Flatnotes +## Flatnotes [Flatnotes](https://github.com/dullage/flatnotes) is a **lightweight, self-hosted note-taking app** that stores notes in plain text Markdown files. With a simple yet powerful interface, Flatnotes offers **tag-based organization**, **full-text search**, and a **distraction-free writing experience**. By integrating Tailscale, you can keep your notes private and secure, ensuring that only trusted devices can access them. -## Key Features +## Key Features -- **Markdown-Based Notes** ā€“ Write and store notes in Markdown format for flexibility. -- **Tag-Based Organization** ā€“ Easily categorize and manage notes with tags. -- **Full-Text Search** ā€“ Quickly find notes with an efficient search function. -- **Self-Hosted Privacy** ā€“ Keep full control of your data without relying on third-party services. -- **Secure Access with Tailscale** ā€“ Restrict access to only authorized devices within your private network. +- **Markdown-Based Notes** ā€“ Write and store notes in Markdown format for flexibility. +- **Tag-Based Organization** ā€“ Easily categorize and manage notes with tags. +- **Full-Text Search** ā€“ Quickly find notes with an efficient search function. +- **Self-Hosted Privacy** ā€“ Keep full control of your data without relying on third-party services. +- **Secure Access with Tailscale** ā€“ Restrict access to only authorized devices within your private network. -## Configuration Overview +## Configuration Overview -In this setup, the `tailscale-flatnotes` service runs Tailscale, which manages secure networking for the Flatnotes service. The `flatnotes` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Flatnotesā€™ web interface and note storage are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing your notes. +In this setup, the `tailscale-flatnotes` service runs Tailscale, which manages secure networking for the Flatnotes service. The `flatnotes` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Flatnotesā€™ web interface and note storage are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing your notes. diff --git a/services/forgejo/README.md b/services/forgejo/README.md index b779a3ea..d53c84ad 100644 --- a/services/forgejo/README.md +++ b/services/forgejo/README.md @@ -19,7 +19,7 @@ This Docker Compose configuration sets up [**Forgejo**](https://forgejo.org/) wi ## Configuration Overview -In this deployment, the `tailscale-forgejo` service runs the Tailscale client to establish a secure private network. The `forgejo` container uses `network_mode: service:tailscale-forgejo` to route all traffic through the Tailscale interface. This ensures your Git service, web interface, and API endpoints are only accessible via Tailscale, preventing public exposure while still offering seamless remote access to your team. +In this deployment, the `tailscale-forgejo` service runs the Tailscale client to establish a secure private network. The `forgejo` container uses `network_mode: service:tailscale` to route all traffic through the Tailscale interface. This ensures your Git service, web interface, and API endpoints are only accessible via Tailscale, preventing public exposure while still offering seamless remote access to your team. ## Reference Material diff --git a/services/formbricks/.env b/services/formbricks/.env index 0167f955..9e5388ce 100644 --- a/services/formbricks/.env +++ b/services/formbricks/.env @@ -11,7 +11,8 @@ SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/formbricks/README.md b/services/formbricks/README.md index 2538f729..01e08d65 100644 --- a/services/formbricks/README.md +++ b/services/formbricks/README.md @@ -29,7 +29,7 @@ Feedback data can include sensitive product insights, internal metrics, and pers In this deployment, a **Tailscale sidecar container** (for example `tailscale-formbricks`) runs the Tailscale client and joins your private Tailscale network. The main `formbricks` service uses: ```plain -network_mode: service:tailscale-formbricks +network_mode: service:tailscale ``` This configuration routes all inbound and outbound traffic through the Tailscale interface, ensuring that the Formbricks admin UI, APIs, and feedback endpoints are accessible **only via your Tailscale network**. This keeps sensitive feedback data protected while still allowing secure access for authorized team members. diff --git a/services/formbricks/compose.yaml b/services/formbricks/compose.yaml index 9e9b19ed..0aa2be89 100644 --- a/services/formbricks/compose.yaml +++ b/services/formbricks/compose.yaml @@ -77,7 +77,7 @@ services: - CRON_SECRET=${CRON_SECRET} - REDIS_URL=${REDIS_URL} - LOG_LEVEL=${LOG_LEVEL} - - ENTERPRISE_LICENSE_KEY=${ENTERPRISE_LICENSE_KEY} + - ENTERPRISE_LICENSE_KEY=${ENTERPRISE_LICENSE_KEY:-} - MAIL_FROM=${MAIL_FROM} - MAIL_FROM_NAME=${MAIL_FROM_NAME} - SMTP_HOST=${SMTP_HOST} @@ -91,52 +91,52 @@ services: - PASSWORD_RESET_DISABLED=${PASSWORD_RESET_DISABLED} - EMAIL_AUTH_DISABLED=${EMAIL_AUTH_DISABLED} - INVITE_DISABLED=${INVITE_DISABLED} - - ASSET_PREFIX_URL=${ASSET_PREFIX_URL} - - UNSPLASH_ACCESS_KEY=${UNSPLASH_ACCESS_KEY} + - ASSET_PREFIX_URL=${ASSET_PREFIX_URL:-} + - UNSPLASH_ACCESS_KEY=${UNSPLASH_ACCESS_KEY:-} - PUBLIC_URL=${PUBLIC_URL} - - SENTRY_DSN=${SENTRY_DSN} - - SENTRY_AUTH_TOKEN=${SENTRY_AUTH_TOKEN} - - SENTRY_ENVIRONMENT=${SENTRY_ENVIRONMENT} - - S3_ACCESS_KEY=${S3_ACCESS_KEY} - - S3_SECRET_KEY=${S3_SECRET_KEY} - - S3_REGION=${S3_REGION} - - S3_BUCKET_NAME=${S3_BUCKET_NAME} - - S3_ENDPOINT_URL=${S3_ENDPOINT_URL} + - SENTRY_DSN=${SENTRY_DSN:-} + - SENTRY_AUTH_TOKEN=${SENTRY_AUTH_TOKEN:-} + - SENTRY_ENVIRONMENT=${SENTRY_ENVIRONMENT:-} + - S3_ACCESS_KEY=${S3_ACCESS_KEY:-} + - S3_SECRET_KEY=${S3_SECRET_KEY:-} + - S3_REGION=${S3_REGION:-} + - S3_BUCKET_NAME=${S3_BUCKET_NAME:-} + - S3_ENDPOINT_URL=${S3_ENDPOINT_URL:-} - S3_FORCE_PATH_STYLE=${S3_FORCE_PATH_STYLE} - - TURNSTILE_SITE_KEY=${TURNSTILE_SITE_KEY} - - TURNSTILE_SECRET_KEY=${TURNSTILE_SECRET_KEY} - - RECAPTCHA_SITE_KEY=${RECAPTCHA_SITE_KEY} - - RECAPTCHA_SECRET_KEY=${RECAPTCHA_SECRET_KEY} - - GITHUB_ID=${GITHUB_ID} - - GITHUB_SECRET=${GITHUB_SECRET} - - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID} - - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET} - - AZUREAD_CLIENT_ID=${AZUREAD_CLIENT_ID} - - AZUREAD_CLIENT_SECRET=${AZUREAD_CLIENT_SECRET} - - AZUREAD_TENANT_ID=${AZUREAD_TENANT_ID} - - OIDC_CLIENT_ID=${OIDC_CLIENT_ID} - - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET} - - OIDC_ISSUER=${OIDC_ISSUER} - - OIDC_DISPLAY_NAME=${OIDC_DISPLAY_NAME} - - OIDC_SIGNING_ALGORITHM=${OIDC_SIGNING_ALGORITHM} - - SAML_DATABASE_URL=${SAML_DATABASE_URL} - - NOTION_OAUTH_CLIENT_ID=${NOTION_OAUTH_CLIENT_ID} - - NOTION_OAUTH_CLIENT_SECRET=${NOTION_OAUTH_CLIENT_SECRET} - - GOOGLE_SHEETS_CLIENT_ID=${GOOGLE_SHEETS_CLIENT_ID} - - GOOGLE_SHEETS_CLIENT_SECRET=${GOOGLE_SHEETS_CLIENT_SECRET} - - GOOGLE_SHEETS_REDIRECT_URL=${GOOGLE_SHEETS_REDIRECT_URL} - - AIRTABLE_CLIENT_ID=${AIRTABLE_CLIENT_ID} - - SLACK_CLIENT_ID=${SLACK_CLIENT_ID} - - SLACK_CLIENT_SECRET=${SLACK_CLIENT_SECRET} - - PRIVACY_URL=${PRIVACY_URL} - - TERMS_URL=${TERMS_URL} - - IMPRINT_URL=${IMPRINT_URL} - - IMPRINT_ADDRESS=${IMPRINT_ADDRESS} + - TURNSTILE_SITE_KEY=${TURNSTILE_SITE_KEY:-} + - TURNSTILE_SECRET_KEY=${TURNSTILE_SECRET_KEY:-} + - RECAPTCHA_SITE_KEY=${RECAPTCHA_SITE_KEY:-} + - RECAPTCHA_SECRET_KEY=${RECAPTCHA_SECRET_KEY:-} + - GITHUB_ID=${GITHUB_ID:-} + - GITHUB_SECRET=${GITHUB_SECRET:-} + - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-} + - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-} + - AZUREAD_CLIENT_ID=${AZUREAD_CLIENT_ID:-} + - AZUREAD_CLIENT_SECRET=${AZUREAD_CLIENT_SECRET:-} + - AZUREAD_TENANT_ID=${AZUREAD_TENANT_ID:-} + - OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-} + - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-} + - OIDC_ISSUER=${OIDC_ISSUER:-} + - OIDC_DISPLAY_NAME=${OIDC_DISPLAY_NAME:-} + - OIDC_SIGNING_ALGORITHM=${OIDC_SIGNING_ALGORITHM:-} + - SAML_DATABASE_URL=${SAML_DATABASE_URL:-} + - NOTION_OAUTH_CLIENT_ID=${NOTION_OAUTH_CLIENT_ID:-} + - NOTION_OAUTH_CLIENT_SECRET=${NOTION_OAUTH_CLIENT_SECRET:-} + - GOOGLE_SHEETS_CLIENT_ID=${GOOGLE_SHEETS_CLIENT_ID:-} + - GOOGLE_SHEETS_CLIENT_SECRET=${GOOGLE_SHEETS_CLIENT_SECRET:-} + - GOOGLE_SHEETS_REDIRECT_URL=${GOOGLE_SHEETS_REDIRECT_URL:-} + - AIRTABLE_CLIENT_ID=${AIRTABLE_CLIENT_ID:-} + - SLACK_CLIENT_ID=${SLACK_CLIENT_ID:-} + - SLACK_CLIENT_SECRET=${SLACK_CLIENT_SECRET:-} + - PRIVACY_URL=${PRIVACY_URL:-} + - TERMS_URL=${TERMS_URL:-} + - IMPRINT_URL=${IMPRINT_URL:-} + - IMPRINT_ADDRESS=${IMPRINT_ADDRESS:-} - RATE_LIMITING_DISABLED=${RATE_LIMITING_DISABLED} - AUDIT_LOG_ENABLED=${AUDIT_LOG_ENABLED} - AUDIT_LOG_GET_USER_IP=${AUDIT_LOG_GET_USER_IP} - AUTH_SKIP_INVITE_FOR_SSO=${AUTH_SKIP_INVITE_FOR_SSO} - - AUTH_SSO_DEFAULT_TEAM_ID=${AUTH_SSO_DEFAULT_TEAM_ID} + - AUTH_SSO_DEFAULT_TEAM_ID=${AUTH_SSO_DEFAULT_TEAM_ID:-} - USER_MANAGEMENT_MINIMUM_ROLE=${USER_MANAGEMENT_MINIMUM_ROLE} - SESSION_MAX_AGE=${SESSION_MAX_AGE} volumes: diff --git a/services/fossflow/README.md b/services/fossflow/README.md index c5e022ba..15336f70 100644 --- a/services/fossflow/README.md +++ b/services/fossflow/README.md @@ -17,4 +17,4 @@ FossFLOW is a free and open-source flow **visualization** tool. Unlike automatio ## Configuration Overview -This setup includes a `tailscale-fossflow` container running the Tailscale client to establish a secure connection. The `fossflow` container uses `network_mode: service:tailscale-fossflow`, ensuring all traffic routes through Tailscale. This keeps your flow diagrams accessible only to authenticated devices within your Tailnet, with no exposure to the public internet. +This setup includes a `tailscale-fossflow` container running the Tailscale client to establish a secure connection. The `fossflow` container uses `network_mode: service:tailscale`, ensuring all traffic routes through Tailscale. This keeps your flow diagrams accessible only to authenticated devices within your Tailnet, with no exposure to the public internet. diff --git a/services/freshrss/.env b/services/freshrss/.env index 7b41415d..ee2693f1 100644 --- a/services/freshrss/.env +++ b/services/freshrss/.env @@ -15,7 +15,8 @@ TS_AUTHKEY= # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones -TAILNET_NAME= # Include the ".ts.net" if it is part of your Tailnet name +TAILNET_NAME= +# Include the ".ts.net" if it is part of your Tailnet name # FreshRSS Configuration # You must set these before the first start. They are only applied while the data diff --git a/services/frigate/.env b/services/frigate/.env index c7580701..d4890877 100644 --- a/services/frigate/.env +++ b/services/frigate/.env @@ -11,7 +11,8 @@ SERVICEPORT=8971 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/frigate/README.md b/services/frigate/README.md index b86293a6..454141a9 100644 --- a/services/frigate/README.md +++ b/services/frigate/README.md @@ -10,7 +10,7 @@ Frigate is often paired with Tailscale to ensure that camera feeds, recordings, ## Configuration Overview -In this setup, the `tailscale-frigate` service runs Tailscale, which manages secure networking for Frigate. The `frigate` container shares the network stack using Dockerā€™s `network_mode: service:tailscale-frigate`. +In this setup, the `tailscale-frigate` service runs Tailscale, which manages secure networking for Frigate. The `frigate` container shares the network stack using Dockerā€™s `network_mode: service:tailscale`. This ensures: diff --git a/services/ghost/.env b/services/ghost/.env index 9c309958..5a6d7b51 100644 --- a/services/ghost/.env +++ b/services/ghost/.env @@ -7,7 +7,7 @@ SERVICE=ghost IMAGE_URL=ghost:5-alpine # Network Configuration -SERVICEPORT=8080 +SERVICEPORT=2368 DNS_SERVER=9.9.9.9 # Tailscale Configuration @@ -19,4 +19,7 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim # Optional Service variables # PUID=1000 +# Public URL used by Ghost to build links and redirects. Replace the placeholder with your Tailnet hostname. +GHOST_URL=https://ghost..ts.net + #EXAMPLE_VAR="Environment varibale" diff --git a/services/ghost/README.md b/services/ghost/README.md index 5dfbfaa0..e47a8313 100644 --- a/services/ghost/README.md +++ b/services/ghost/README.md @@ -16,4 +16,6 @@ This Docker Compose configuration sets up **[Ghost](https://github.com/TryGhost/ ## Configuration Overview -In this setup, the `tailscale-ghost` service runs Tailscale, which manages secure networking for the Ghost service. The `ghost` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Ghostā€™s web interface and publishing tools are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy to your publishing workflow. +In this setup, the `tailscale-ghost` service runs Tailscale, which manages secure networking for the Ghost service. The `ghost` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Ghostā€™s web interface and publishing tools are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy to your publishing workflow. + +Set `GHOST_URL` in `.env` to the HTTPS hostname that you use on your Tailnet. Ghost listens on port `2368`, and Tailscale Serve forwards HTTPS traffic to that port. diff --git a/services/ghost/compose.yaml b/services/ghost/compose.yaml index 0e1bbd50..13ef80f5 100644 --- a/services/ghost/compose.yaml +++ b/services/ghost/compose.yaml @@ -4,7 +4,7 @@ configs: {"TCP":{"443":{"HTTPS":true}}, "Web":{"$${TS_CERT_DOMAIN}:443": {"Handlers":{"/": - {"Proxy":"http://127.0.0.1:80"}}}}, + {"Proxy":"http://127.0.0.1:2368"}}}}, "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: @@ -61,7 +61,7 @@ services: database__connection__database: ghost # this url value is just an example, and is likely wrong for your environment! - url: http://localhost:8080 + url: ${GHOST_URL} # contrary to the default mentioned in the linked documentation, this image defaults to NODE_ENV=production (so development mode needs to be explicitly specified if desired) #NODE_ENV: development diff --git a/services/gitea/README.md b/services/gitea/README.md index 1a8d850e..f8852494 100644 --- a/services/gitea/README.md +++ b/services/gitea/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up [Gitea](https://gitea.com/) with Tails ## Configuration Overview -In this deployment, the `tailscale-gitea` service runs the Tailscale client to establish a secure private network. The `gitea` container uses `network_mode: service:tailscale-gitea` to route all traffic through the Tailscale interface. This ensures your Git service, web interface, and API endpoints are only accessible via Tailscale, preventing public exposure while still offering seamless remote access to your team. +In this deployment, the `tailscale-gitea` service runs the Tailscale client to establish a secure private network. The `gitea` container uses `network_mode: service:tailscale` to route all traffic through the Tailscale interface. This ensures your Git service, web interface, and API endpoints are only accessible via Tailscale, preventing public exposure while still offering seamless remote access to your team. diff --git a/services/gitsave/README.md b/services/gitsave/README.md index 2ac17176..f9c6e5e9 100644 --- a/services/gitsave/README.md +++ b/services/gitsave/README.md @@ -17,4 +17,4 @@ This Docker Compose configuration sets up [**GitSave**](https://github.com/TimWi ## Configuration Overview -In this deployment, the `tailscale-gitsave` service runs the Tailscale client to establish a secure private network. The `gitsave` container uses `network_mode: service:tailscale-gitsave` to route all traffic through the Tailscale interface. This ensures that your GitHub backup service and its API endpoints are only accessible via Tailscale, preventing public exposure. +In this deployment, the `tailscale-gitsave` service runs the Tailscale client to establish a secure private network. The `gitsave` container uses `network_mode: service:tailscale` to route all traffic through the Tailscale interface. This ensures that your GitHub backup service and its API endpoints are only accessible via Tailscale, preventing public exposure. diff --git a/services/glance/README.md b/services/glance/README.md index 19596432..62c90bb1 100644 --- a/services/glance/README.md +++ b/services/glance/README.md @@ -10,4 +10,4 @@ To install Glance properly, make sure to add the files glance.yml and home.yml t ## Configuration Overview -In this setup, the `tailscale-glance` service runs Tailscale, which provides secure networking for the Glance service. The `glance` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that the Glance dashboard is only accessible through the Tailscale network (or locally, if desired), adding a robust layer of privacy and security to your self-hosted monitoring setup. +In this setup, the `tailscale-glance` service runs Tailscale, which provides secure networking for the Glance service. The `glance` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that the Glance dashboard is only accessible through the Tailscale network (or locally, if desired), adding a robust layer of privacy and security to your self-hosted monitoring setup. diff --git a/services/gokapi/README.md b/services/gokapi/README.md index 597a79ae..a1289ac4 100644 --- a/services/gokapi/README.md +++ b/services/gokapi/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Gokapi](https://github.com/Forceu/Gok ## Configuration Overview -In this setup, the `tailscale-gokapi` service runs Tailscale, which manages secure networking for the Gokapi service. The `gokapi` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Gokapi's web interface and file-sharing services are only accessible through the Tailscale network (or locally, if preferred), providing an additional layer of security and privacy for your file-sharing solution. +In this setup, the `tailscale-gokapi` service runs Tailscale, which manages secure networking for the Gokapi service. The `gokapi` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Gokapi's web interface and file-sharing services are only accessible through the Tailscale network (or locally, if preferred), providing an additional layer of security and privacy for your file-sharing solution. diff --git a/services/gotify/README.md b/services/gotify/README.md index f3ca6474..e846b7e6 100644 --- a/services/gotify/README.md +++ b/services/gotify/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up [Gotify](https://github.com/gotify/ser ## Configuration Overview -In this deployment, the `tailscale-gotify` service runs the Tailscale client to establish a secure private network. The `gotify` container uses `network_mode: service:tailscale-gotify` to route its traffic through the Tailscale interface. This ensures that the Gotify web UI and backend services are only reachable via your Tailscale network, keeping your notifications safe from public exposure. +In this deployment, the `tailscale-gotify` service runs the Tailscale client to establish a secure private network. The `gotify` container uses `network_mode: service:tailscale` to route its traffic through the Tailscale interface. This ensures that the Gotify web UI and backend services are only reachable via your Tailscale network, keeping your notifications safe from public exposure. diff --git a/services/grampsweb/README.md b/services/grampsweb/README.md index ac8809f9..6239ee2b 100644 --- a/services/grampsweb/README.md +++ b/services/grampsweb/README.md @@ -19,4 +19,4 @@ This Docker Compose configuration sets up [**Gramps Web**](https://github.com/gr ## Configuration Overview -In this deployment, the `tailscale-grampsweb` service runs the Tailscale client to establish a secure private network. The `grampsweb` container uses `network_mode: service:tailscale-grampsweb` to route all traffic through the Tailscale interface. This ensures that your genealogy database, charts, and administration interface are only accessible via Tailscale, preventing public exposure. +In this deployment, the `tailscale-grampsweb` service runs the Tailscale client to establish a secure private network. The `grampsweb` container uses `network_mode: service:tailscale` to route all traffic through the Tailscale interface. This ensures that your genealogy database, charts, and administration interface are only accessible via Tailscale, preventing public exposure. diff --git a/services/haptic/README.md b/services/haptic/README.md index a4b7d691..e82b60e9 100644 --- a/services/haptic/README.md +++ b/services/haptic/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[Haptic](https://github.com/chroxify ## Configuration Overview -In this setup, the `tailscale-haptic` service runs Tailscale, which manages secure networking for the Haptic service. The `haptic` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Hapticā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing your bookmarks. +In this setup, the `tailscale-haptic` service runs Tailscale, which manages secure networking for the Haptic service. The `haptic` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Hapticā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing your bookmarks. diff --git a/services/hemmelig/README.md b/services/hemmelig/README.md index 92950dcb..b03c880b 100644 --- a/services/hemmelig/README.md +++ b/services/hemmelig/README.md @@ -25,7 +25,7 @@ While a public SaaS instance of Hemmelig (e.g., hemmelig.app) exists, **self-hos In this deployment, a **Tailscale sidecar container** (e.g., `tailscale-hemmelig`) runs the Tailscale client and joins your private Tailscale network. The main `hemmelig` service uses: ```plain -network_mode: service:tailscale-hemmelig +network_mode: service:tailscale ``` This effectively **routes all traffic through the Tailscale network interface**, making the app private and unreachable from the public Internet while still accessible to any device on your Tailscale network. Remote team members can securely access the Hemmelig web UI, API, and encryption features over Tailscale without exposing the app publicly. diff --git a/services/homarr/README.md b/services/homarr/README.md index 61ebe760..6df9a06c 100644 --- a/services/homarr/README.md +++ b/services/homarr/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Homarr](https://github.com/ajnart/hom ## Configuration Overview -In this setup, the tailscale-homarr service runs Tailscale, which manages secure networking for the Homarr service. The homarr service uses the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that Homarrā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted dashboard. +In this setup, the tailscale-homarr service runs Tailscale, which manages secure networking for the Homarr service. The homarr service uses the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that Homarrā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted dashboard. diff --git a/services/home-assistant/README.md b/services/home-assistant/README.md index 2b36d106..fc207c21 100644 --- a/services/home-assistant/README.md +++ b/services/home-assistant/README.md @@ -1,28 +1,28 @@ -# Home Assistant with Tailscale Sidecar Configuration +# Home Assistant with Tailscale Sidecar Configuration This Docker Compose configuration sets up **[Home Assistant](https://github.com/home-assistant/)** with Tailscale as a sidecar container to securely manage and access your smart home automation platform over a private Tailscale network. By integrating Tailscale, you can ensure that your Home Assistant instance remains private and accessible only to authorized devices within your Tailscale network. -## Home Assistant +## Home Assistant [Home Assistant](https://github.com/home-assistant/) is an open-source home automation platform that allows you to control and automate smart devices from a unified interface. With support for thousands of integrations, it provides powerful automation capabilities and privacy-focused self-hosted control over your smart home. Pairing Home Assistant with Tailscale ensures a secure, remote-accessible smart home without exposing it to the public internet. -## Key Features +## Key Features -- **Local Control & Privacy** ā€“ Self-hosted and privacy-focused, keeping your data in your home. -- **Extensive Integrations** ā€“ Supports thousands of smart home devices and services. -- **Automation & Customization** ā€“ Create complex automations with YAML or visual editors. -- **Secure Remote Access** ā€“ Pair with Tailscale to safely access your Home Assistant instance from anywhere. +- **Local Control & Privacy** ā€“ Self-hosted and privacy-focused, keeping your data in your home. +- **Extensive Integrations** ā€“ Supports thousands of smart home devices and services. +- **Automation & Customization** ā€“ Create complex automations with YAML or visual editors. +- **Secure Remote Access** ā€“ Pair with Tailscale to safely access your Home Assistant instance from anywhere. -## Configuration Overview +## Configuration Overview -In this setup, the `tailscale-homeassistant` service runs Tailscale, which manages secure networking for the Home Assistant service. The `homeassistant` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Home Assistantā€™s web interface and smart home control features are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for your home automation system. +In this setup, the `tailscale-homeassistant` service runs Tailscale, which manages secure networking for the Home Assistant service. The `homeassistant` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Home Assistantā€™s web interface and smart home control features are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for your home automation system. ## Troubleshooting If you encounter a `400: Bad Request` after deployment, please alter the file `ha-data/config/configurations.yaml` to trust the reverse proxy configuration used by Tailscale. The `configurations.yaml` should look like this. ```plain -$ cat ha-data/config/configuration.yaml +$ cat ha-data/config/configuration.yaml # Loads default set of integrations. Do not remove. default_config: diff --git a/services/homebox/.env b/services/homebox/.env index a00750b2..8b26cd80 100644 --- a/services/homebox/.env +++ b/services/homebox/.env @@ -11,7 +11,8 @@ SERVICEPORT=7745 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/homebox/README.md b/services/homebox/README.md index c5823c2b..cccee25d 100644 --- a/services/homebox/README.md +++ b/services/homebox/README.md @@ -30,7 +30,7 @@ When combined with Tailscale, Homebox becomes a **secure, Tailnet-only inventory In this deployment, a **Tailscale sidecar container** (for example `tailscale-homebox`) runs the Tailscale client and joins your private Tailscale network. The main `homebox` service uses: ```plain -network_mode: service:tailscale-homebox +network_mode: service:tailscale ``` This configuration routes all inbound and outbound traffic through the Tailscale interface, ensuring that the Homebox web UI and API are accessible **only via your Tailscale network**. No public port exposure is required unless explicitly configured. diff --git a/services/homepage/README.md b/services/homepage/README.md index b04f85d4..c1b93a30 100644 --- a/services/homepage/README.md +++ b/services/homepage/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Homepage](https://github.com/gethomep ## Configuration Overview -In this setup, the `tailscale-homepage` service runs Tailscale, which manages secure networking for the Homepage service. The `homepage` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Homepageā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted dashboard. +In this setup, the `tailscale-homepage` service runs Tailscale, which manages secure networking for the Homepage service. The `homepage` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Homepageā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted dashboard. diff --git a/services/hytale/.env b/services/hytale/.env index b873a677..73f5a89b 100644 --- a/services/hytale/.env +++ b/services/hytale/.env @@ -14,13 +14,12 @@ DNS_SERVER=1.1.1.1 TS_AUTHKEY= # Time Zone setting for containers -TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones +TZ=US/Eastern # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Hytale Configuration SERVER_IP=0.0.0.0 SERVER_PORT=5520 PROD=FALSE DEBUG=FALSE -TZ=US/Eastern #EXAMPLE_VAR="Environment varibale" diff --git a/services/immich/.env b/services/immich/.env index ccbf69ab..2fe63f51 100644 --- a/services/immich/.env +++ b/services/immich/.env @@ -28,8 +28,7 @@ UPLOAD_LOCATION=./library # The location where your database files are stored. Network shares are not supported for the database DB_DATA_LOCATION=./postgres -# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List -TZ=Europe/Amsterdam +# To set a timezone, change the TZ value above to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List # The Immich version to use. You can pin this to a specific version like "v1.71.0" IMMICH_VERSION=release diff --git a/services/immich/README.md b/services/immich/README.md index bfca4b23..a4b447c9 100644 --- a/services/immich/README.md +++ b/services/immich/README.md @@ -19,4 +19,4 @@ Immich is a self-hosted, high-performance solution for backing up and browsing p ## Configuration Overview -In this deployment, the `tailscale-immich` service runs the Tailscale client to establish a secure private network. The `immich` container uses `network_mode: service:tailscale-immich` to route its traffic through the Tailscale interface. This ensures that the Immich web UI and backend services are only reachable via your Tailscale network, keeping your personal media safe from public exposure. +In this deployment, the `tailscale-immich` service runs the Tailscale client to establish a secure private network. The `immich` container uses `network_mode: service:tailscale` to route its traffic through the Tailscale interface. This ensures that the Immich web UI and backend services are only reachable via your Tailscale network, keeping your personal media safe from public exposure. diff --git a/services/isley/README.md b/services/isley/README.md index c0a7013d..a3d650ea 100644 --- a/services/isley/README.md +++ b/services/isley/README.md @@ -24,4 +24,4 @@ With integration options for popular grow equipment, Isley simplifies and elevat ## Configuration Overview -In this setup, the `tailscale-isley` service runs Tailscale, which manages secure networking for the Isley service. The `isley` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Isley's interface is not exposed to the public internet, protecting your grow journal and data with an additional layer of privacy. +In this setup, the `tailscale-isley` service runs Tailscale, which manages secure networking for the Isley service. The `isley` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Isley's interface is not exposed to the public internet, protecting your grow journal and data with an additional layer of privacy. diff --git a/services/it-tools/README.md b/services/it-tools/README.md index 0e7cd15f..7c3999c5 100644 --- a/services/it-tools/README.md +++ b/services/it-tools/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [IT-Tools](https://github.com/Corentin ## Configuration Overview -In this setup, the `tailscale-it-tools` service runs Tailscale, which manages secure networking for the IT-Tools service. The `it-tools` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that IT-Toolsā€™ web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted developer utilities. +In this setup, the `tailscale-it-tools` service runs Tailscale, which manages secure networking for the IT-Tools service. The `it-tools` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that IT-Toolsā€™ web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted developer utilities. diff --git a/services/jellyfin/README.md b/services/jellyfin/README.md index d8664eb4..1547ac48 100644 --- a/services/jellyfin/README.md +++ b/services/jellyfin/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Jellyfin](https://github.com/jellyfin ## Configuration Overview -In this setup, the tailscale-jellyfin service runs Tailscale, which manages secure networking for the Jellyfin service. The jellyfin service uses the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that Jellyfinā€™s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted media server. +In this setup, the tailscale-jellyfin service runs Tailscale, which manages secure networking for the Jellyfin service. The jellyfin service uses the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that Jellyfinā€™s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted media server. diff --git a/services/kaneo/.env b/services/kaneo/.env index 5ee5eec1..f03f0320 100644 --- a/services/kaneo/.env +++ b/services/kaneo/.env @@ -16,7 +16,8 @@ SERVICEPORT_DATABASE=5432 DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 @@ -32,20 +33,11 @@ KANEO_CLIENT_URL="https://kaneo..ts.net" # AUTH Configuration AUTH_SECRET= -BETTER_AUTH_TRUSTED_PROXIES: "0.0.0.0/0" +BETTER_AUTH_TRUSTED_PROXIES=0.0.0.0/0 # DB Configuration DB_USERNAME=kaneo DB_DATABASE_NAME=kaneo DB_PASSWORD= -# Tailscale Configuration -TS_AUTHKEY= - -# Time Zone setting for containers -TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones - -# Optional Service variables -# PUID=1000 - #EXAMPLE_VAR="Environment varibale" diff --git a/services/kaneo/README.md b/services/kaneo/README.md index cd542b2d..82ce868c 100644 --- a/services/kaneo/README.md +++ b/services/kaneo/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[Kaneo](https://github.com/usekaneo/ ## Configuration Overview -In this setup, the `tailscale-kaneo` service runs Tailscale, which manages secure networking for the Kaneo service. The `kaneo` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Kaneoā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), adding a strong layer of privacy and security to your self-hosted project management platform. +In this setup, the `tailscale-kaneo` service runs Tailscale, which manages secure networking for the Kaneo service. The `kaneo` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Kaneoā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), adding a strong layer of privacy and security to your self-hosted project management platform. diff --git a/services/karakeep/.env b/services/karakeep/.env index 4778fd2d..8eb3df54 100644 --- a/services/karakeep/.env +++ b/services/karakeep/.env @@ -4,7 +4,8 @@ # Service Configuration SERVICE=karakeep -IMAGE_URL= # Docker image URL from container registry (e.g., adguard/adguard-home). +IMAGE_URL= +# Docker image URL from container registry (e.g., adguard/adguard-home). # Network Configuration SERVICEPORT=3000 diff --git a/services/karakeep/README.md b/services/karakeep/README.md index 5e43d5e8..614d4bbe 100644 --- a/services/karakeep/README.md +++ b/services/karakeep/README.md @@ -34,4 +34,4 @@ This Docker Compose configuration sets up **[Karakeep](https://github.com/karake ## Configuration Overview -In this setup, the `tailscale-karakeep` service runs Tailscale, which manages secure networking for the Karakeep service. The `karakeep` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Karakeepā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), enhancing the privacy and security of your notes and collaborative workspace. +In this setup, the `tailscale-karakeep` service runs Tailscale, which manages secure networking for the Karakeep service. The `karakeep` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Karakeepā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), enhancing the privacy and security of your notes and collaborative workspace. diff --git a/services/kavita/README.md b/services/kavita/README.md index 05185484..869abc89 100644 --- a/services/kavita/README.md +++ b/services/kavita/README.md @@ -17,7 +17,7 @@ This Docker Compose configuration sets up [Kavita](https://github.com/Kareadita/ ## Configuration Overview -In this setup, the `tailscale-kavita` service runs the Tailscale client to join your private mesh network. The `kavita` service is configured with `network_mode: service:tailscale-kavita`, so all network traffic for Kavita is routed through the Tailscale container. This ensures the web UI and API are reachable only via your Tailscale network (or locally), adding an extra layer of privacy and security to your self-hosted library. +In this setup, the `tailscale-kavita` service runs the Tailscale client to join your private mesh network. The `kavita` service is configured with `network_mode: service:tailscale`, so all network traffic for Kavita is routed through the Tailscale container. This ensures the web UI and API are reachable only via your Tailscale network (or locally), adding an extra layer of privacy and security to your self-hosted library. ## Files to check diff --git a/services/kitchenowl/.env b/services/kitchenowl/.env index 43895e9f..670260b1 100755 --- a/services/kitchenowl/.env +++ b/services/kitchenowl/.env @@ -11,7 +11,8 @@ SERVICEPORT=8080 DNS_SERVER=9.9.9.9 # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones @@ -21,9 +22,10 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim #EXAMPLE_VAR="Environment varibale" -JWT_SECRET_KEY= # Generate a random string for JWT secret key, e.g., using: openssl rand -base64 32 +JWT_SECRET_KEY= +# Generate a random string for JWT secret key, e.g., using: openssl rand -base64 32 FRONT_URL=https://kitchenowl..ts.net # the exact URL of your kitchenowl instance, required when using OIDC authentication, e.g https://kitchenowl.example.com #OIDC_ISSUER= # your OIDC issuer, e.g https://accounts.google.com #OIDC_CLIENT_ID= # to be generated by your OIDC provider -#OIDC_CLIENT_SECRET= # to be generated by your OIDC provider \ No newline at end of file +#OIDC_CLIENT_SECRET= # to be generated by your OIDC provider diff --git a/services/kitchenowl/README.md b/services/kitchenowl/README.md index ac5f3d72..84869ad6 100644 --- a/services/kitchenowl/README.md +++ b/services/kitchenowl/README.md @@ -21,7 +21,7 @@ Kitchenowl is useful for families, housemates, and home labs that want a private ## Tailscale Integration -This setup uses a **Tailscale sidecar container** to provide secure private networking for Kitchenowl. The Kitchenowl container shares the Tailscale container's network stack using Docker's `network_mode: service:` pattern. +This setup uses a **Tailscale sidecar container** to provide secure private networking for Kitchenowl. The Kitchenowl container shares the Tailscale container's network stack using Docker's `network_mode: service:tailscale` pattern. Because of this, Kitchenowl does not need to publish ports directly to the host. Instead, you access the web interface through the Tailscale hostname or Tailnet IP assigned to the sidecar. This keeps the service private, reduces exposure, and avoids the need for public DNS, inbound firewall rules, or a public reverse proxy. diff --git a/services/languagetool/README.md b/services/languagetool/README.md index 50bdec3a..7d5692a4 100644 --- a/services/languagetool/README.md +++ b/services/languagetool/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [LanguageTool](https://languagetool.or ## Configuration Overview -In this setup, the `tailscale-adguardhome` service runs Tailscale, which manages secure networking for LanguageTool. The `languagetool` service utilizes the Tailscale network stack via Docker's `network_mode: service:`. This setup ensures that LanguageTool's service is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your LanguageTool deployment. +In this setup, the `tailscale-adguardhome` service runs Tailscale, which manages secure networking for LanguageTool. The `languagetool` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale`. This setup ensures that LanguageTool's service is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your LanguageTool deployment. ## Using n-gram datasets diff --git a/services/linkding/README.md b/services/linkding/README.md index f59647dc..27fbd4e9 100644 --- a/services/linkding/README.md +++ b/services/linkding/README.md @@ -15,4 +15,4 @@ This Docker Compose configuration sets up [Linkding](https://github.com/sissbrue ## Configuration Overview -In this setup, the `tailscale-linkding` service runs Tailscale, which manages secure networking for the Linkding service. The `linkding` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Linkdingā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for managing your bookmarks. +In this setup, the `tailscale-linkding` service runs Tailscale, which manages secure networking for the Linkding service. The `linkding` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Linkdingā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for managing your bookmarks. diff --git a/services/lube-logger/README.md b/services/lube-logger/README.md index 6a12b993..b9c9a84a 100644 --- a/services/lube-logger/README.md +++ b/services/lube-logger/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[LubeLogger](https://github.com/harg ## Configuration Overview -In this deployment, the `tailscale-lubelogger` service runs the Tailscale client to establish a secure private network. The `lubelogger` container uses `network_mode: service:tailscale-lubelogger` to tunnel its network traffic through the Tailscale network interface. This ensures that the web UI is accessible only through Tailscale, keeping your vehicle data safe from public exposure. +In this deployment, the `tailscale-lubelogger` service runs the Tailscale client to establish a secure private network. The `lubelogger` container uses `network_mode: service:tailscale` to tunnel its network traffic through the Tailscale network interface. This ensures that the web UI is accessible only through Tailscale, keeping your vehicle data safe from public exposure. diff --git a/services/mailpit/.env b/services/mailpit/.env index 5a4e1031..050ce1de 100644 --- a/services/mailpit/.env +++ b/services/mailpit/.env @@ -11,7 +11,8 @@ SERVICEPORT=8025 # Mailpit web port. It is not exposed locally; Tailscale Serve DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 @@ -26,4 +27,4 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim MAIL_DOMAIN_REGEX='@example\.com$' # Catch all recipients at example.com; change this to your escaped domain. MAILPIT_MAX_MESSAGES=0 # Maximum stored messages; 0 disables count-based pruning. MAILPIT_MAX_AGE=90d # Delete messages older than this age. Use hours (36h) or days (90d). -MAILPIT_MAX_MESSAGE_SIZE=50 # Maximum accepted message size in MB. \ No newline at end of file +MAILPIT_MAX_MESSAGE_SIZE=50 # Maximum accepted message size in MB. diff --git a/services/mattermost/.env b/services/mattermost/.env index bd11ec92..5b2868de 100644 --- a/services/mattermost/.env +++ b/services/mattermost/.env @@ -33,13 +33,13 @@ CALLS_PORT=8443 # Mattermost settings ## Inside the container the uid and gid is 2000. The folder owner can be set with -## `sudo chown -R 2000:2000 ${PWD}/${SERVICE}-data/mattermost`. -MATTERMOST_CONFIG_PATH=${PWD}/${SERVICE}-data/config -MATTERMOST_DATA_PATH=${PWD}/${SERVICE}-data/data -MATTERMOST_LOGS_PATH=${PWD}/${SERVICE}-data/logs -MATTERMOST_PLUGINS_PATH=${PWD}/${SERVICE}-data/plugins -MATTERMOST_CLIENT_PLUGINS_PATH=${PWD}/${SERVICE}-data/client/plugins -MATTERMOST_BLEVE_INDEXES_PATH=${PWD}/${SERVICE}-data/bleve-indexes +## `sudo chown -R 2000:2000 ./${SERVICE}-data/mattermost`. +MATTERMOST_CONFIG_PATH=./${SERVICE}-data/config +MATTERMOST_DATA_PATH=./${SERVICE}-data/data +MATTERMOST_LOGS_PATH=./${SERVICE}-data/logs +MATTERMOST_PLUGINS_PATH=./${SERVICE}-data/plugins +MATTERMOST_CLIENT_PLUGINS_PATH=./${SERVICE}-data/client/plugins +MATTERMOST_BLEVE_INDEXES_PATH=./${SERVICE}-data/bleve-indexes ## Bleve index (inside the container) MM_BLEVESETTINGS_INDEXDIR=/mattermost/bleve-indexes @@ -53,7 +53,7 @@ MATTERMOST_CONTAINER_READONLY=false # Postgres Settings ## A guide on how to change the database user to a nonsuperuser can be found in docs/creation-of-nonsuperuser.md POSTGRES_IMAGE_TAG=13-alpine -POSTGRES_DATA_PATH=${PWD}/${SERVICE}-data/postgres/data +POSTGRES_DATA_PATH=./${SERVICE}-data/postgres/data POSTGRES_USER=MMus3r ##Please Change POSTGRES_PASSWORD=MMus3r_P4ssword ##Please Change diff --git a/services/mattermost/README.md b/services/mattermost/README.md index 1c6b14d3..ea5fc6a2 100644 --- a/services/mattermost/README.md +++ b/services/mattermost/README.md @@ -1,6 +1,6 @@ # Mattermost with Tailscale Sidecar Configuration -This Docker Compose configuration sets up [Mattermost](https://mattermost.com/platform-overview/) with Tailscale as a sidecar container to securely manage and access your clipboard history over a private Tailscale network. By integrating Tailscale, you can ensure that your Mattermost instance remains private and accessible only to authorized devices on your Tailscale network. +This Docker Compose configuration sets up [Mattermost](https://mattermost.com/platform-overview/) with Tailscale as a sidecar container to securely manage team communication over a private Tailscale network. By integrating Tailscale, you can ensure that your Mattermost instance remains private and accessible only to authorized devices on your Tailscale network. ## Mattermost @@ -17,7 +17,9 @@ This Docker Compose configuration sets up [Mattermost](https://mattermost.com/pl ## Configuration Overview -In this setup, the `tailscale-Mattermost` service runs Tailscale, which manages secure networking for the Mattermost service. The `Mattermost` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Mattermostā€™s web interface and functionality are only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for managing your clipboard history. +In this setup, the `tailscale-Mattermost` container runs Tailscale, which manages secure networking for the Mattermost service. The `Mattermost` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Mattermostā€™s web interface and functionality are only accessible through the Tailscale network unless you enable host port mappings. + +The stack stores Mattermost and PostgreSQL data under the local mattermost-data directory. The path variables in `.env` are relative to this service directory, so the stack does not depend on the shell's current PWD variable. ## Troubleshooting diff --git a/services/mealie/README.md b/services/mealie/README.md index 73baf451..2acd1851 100644 --- a/services/mealie/README.md +++ b/services/mealie/README.md @@ -18,4 +18,4 @@ This Docker Compose configuration sets up [**Mealie**](https://github.com/mealie ## Configuration Overview -In this deployment, the `tailscale-mealie` service runs the Tailscale client to establish a secure private network. The `mealie` container uses `network_mode: service:tailscale-mealie` to route its network traffic through the Tailscale network interface. This configuration ensures that the web UI is only accessible over Tailscale, protecting your recipes and personal data from public exposure. +In this deployment, the `tailscale-mealie` service runs the Tailscale client to establish a secure private network. The `mealie` container uses `network_mode: service:tailscale` to route its network traffic through the Tailscale network interface. This configuration ensures that the web UI is only accessible over Tailscale, protecting your recipes and personal data from public exposure. diff --git a/services/memos/.env b/services/memos/.env index 1f1ff897..483f7993 100644 --- a/services/memos/.env +++ b/services/memos/.env @@ -11,7 +11,8 @@ SERVICEPORT=5230 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/memos/README.md b/services/memos/README.md index ac884843..3bb1bf6a 100644 --- a/services/memos/README.md +++ b/services/memos/README.md @@ -10,7 +10,7 @@ By pairing Memos with Tailscale, you ensure that your notes remain private and a ## Configuration Overview -In this setup, the `tailscale-memos` service runs Tailscale and manages secure networking. The `memos` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale-memos` configuration. This ensures that Memos is only accessible through your Tailnet unless you explicitly expose ports. +In this setup, the `tailscale-memos` service runs Tailscale and manages secure networking. The `memos` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Memos is only accessible through your Tailnet unless you explicitly expose ports. ## Files to check diff --git a/services/metube/README.md b/services/metube/README.md index 2bde43ee..f7c0cdee 100644 --- a/services/metube/README.md +++ b/services/metube/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Metube](https://github.com/alexta69/m ## Configuration Overview -In this setup, the `tailscale-metube` service runs Tailscale, which manages secure networking for the metube application. The `metube` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that metubeā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security. +In this setup, the `tailscale-metube` service runs Tailscale, which manages secure networking for the metube application. The `metube` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that metubeā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security. diff --git a/services/minecraft/.env b/services/minecraft/.env index 86a8031c..a9f03607 100644 --- a/services/minecraft/.env +++ b/services/minecraft/.env @@ -11,7 +11,8 @@ SERVICEPORT=25565 # Port to expose to local network. Uncomment the "ports:" sect DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 diff --git a/services/minecraft/README.md b/services/minecraft/README.md index 9dbdada7..527b2007 100644 --- a/services/minecraft/README.md +++ b/services/minecraft/README.md @@ -26,7 +26,7 @@ No `serve.json` configuration is needed for this service. ## Configuration Overview -In this setup, the `tailscale-minecraft` service runs the Tailscale client to join your private mesh network. The `minecraft` service is configured with `network_mode: service:tailscale-minecraft`, so all network traffic for the game server is routed through the Tailscale container. The Minecraft server binds TCP port 25565, which is reachable only from devices on your Tailnet. +In this setup, the `tailscale-minecraft` service runs the Tailscale client to join your private mesh network. The `minecraft` service is configured with `network_mode: service:tailscale`, so all network traffic for the game server is routed through the Tailscale container. The Minecraft server binds TCP port 25565, which is reachable only from devices on your Tailnet. ## Setup diff --git a/services/minecraft/compose.yaml b/services/minecraft/compose.yaml index 9985e540..277b4197 100644 --- a/services/minecraft/compose.yaml +++ b/services/minecraft/compose.yaml @@ -1,12 +1,3 @@ -configs: - ts-serve: - content: | - {"TCP":{"443":{"HTTPS":true}}, - "Web":{"$${TS_CERT_DOMAIN}:443": - {"Handlers":{"/": - {"Proxy":"http://127.0.0.1:25565"}}}}, - "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} - services: # Make sure you have updated/checked the .env file with the correct variables. # All the ${ xx } need to be defined there. @@ -18,15 +9,11 @@ services: environment: - TS_AUTHKEY=${TS_AUTHKEY} - TS_STATE_DIR=/var/lib/tailscale - - TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS - TS_AUTH_ONCE=true - configs: - - source: ts-serve - target: /config/serve.json volumes: - ./config:/config # Config folder used to store Tailscale files - you may need to change the path - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path diff --git a/services/miniflux/.env b/services/miniflux/.env index 4047e0eb..6f21666d 100644 --- a/services/miniflux/.env +++ b/services/miniflux/.env @@ -15,7 +15,8 @@ TS_AUTHKEY= # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones -TAILNET_NAME= # Include the ".ts.net" if it is part of your Tailnet name +TAILNET_NAME= +# Include the ".ts.net" if it is part of your Tailnet name # Miniflux Configuration # You must set these diff --git a/services/miniflux/README.md b/services/miniflux/README.md index 7cc1e906..7dbfc6e8 100644 --- a/services/miniflux/README.md +++ b/services/miniflux/README.md @@ -17,7 +17,7 @@ This Docker Compose configuration sets up [Miniflux](https://github.com/miniflux ## Configuration Overview -In this deployment, the `tailscale-miniflux` service runs the Tailscale client to establish a secure private network. The `miniflux` application and its `postgres` database both use `network_mode: service:tailscale-miniflux`. This means all services share the same network namespace, allowing them to communicate via `localhost` and keeping the application reachable only via the Tailscale network. +In this deployment, the `tailscale-miniflux` service runs the Tailscale client to establish a secure private network. The `miniflux` application and its `postgres` database both use `network_mode: service:tailscale`. This means all services share the same network namespace, allowing them to communicate via `localhost` and keeping the application reachable only via the Tailscale network. ## Files to check diff --git a/services/miniqr/README.md b/services/miniqr/README.md index 2f655b8f..b5605aa6 100644 --- a/services/miniqr/README.md +++ b/services/miniqr/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[Mini-QR](https://github.com/lyqht/m ## Configuration Overview -In this setup, the `tailscale-miniqr` service runs Tailscale, which handles secure networking for the Mini-QR service. The `mini-qr` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that the Mini-QR web interface is only accessible via your Tailscale network (or locally if preferred), giving you complete control over access and visibility. +In this setup, the `tailscale-miniqr` service runs Tailscale, which handles secure networking for the Mini-QR service. The `mini-qr` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that the Mini-QR web interface is only accessible via your Tailscale network (or locally if preferred), giving you complete control over access and visibility. diff --git a/services/nanote/README.md b/services/nanote/README.md index ebd67b82..83500e38 100644 --- a/services/nanote/README.md +++ b/services/nanote/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[Nanote](https://github.com/omarmir/ ## Configuration Overview -In this setup, the `tailscale-nanote` service runs Tailscale, which manages secure networking for the Nanote service. The `nanote` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Nanoteā€™s web interface and note storage are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy to your note-taking workflow. +In this setup, the `tailscale-nanote` service runs Tailscale, which manages secure networking for the Nanote service. The `nanote` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Nanoteā€™s web interface and note storage are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy to your note-taking workflow. diff --git a/services/navidrome/README.md b/services/navidrome/README.md index ef112169..4ed224e2 100644 --- a/services/navidrome/README.md +++ b/services/navidrome/README.md @@ -17,4 +17,6 @@ Navidrome is a self-hosted music streaming server and web-based player. It allow ## Configuration Overview -In this setup, the `tailscale-navidrome` container runs the Tailscale client and forms a private mesh network. The `navidrome` container is configured with `network_mode: service:tailscale-navidrome`, which routes all of Navidromeā€™s traffic through Tailscale. This ensures that your music server is never exposed publicly, and can only be accessed from devices authenticated through your Tailscale Tailnet. +In this setup, the `tailscale-navidrome` container runs the Tailscale client and forms a private mesh network. The `navidrome` container is configured with `network_mode: service:tailscale`, which routes all of Navidromeā€™s traffic through Tailscale. This ensures that your music server is never exposed publicly, and can only be accessed from devices authenticated through your Tailscale Tailnet. + +Before starting the stack, replace `/path/to/your/music/folder` in `compose.yaml` with the absolute host directory that contains your music library. diff --git a/services/nessus/README.md b/services/nessus/README.md index 5a858959..91f309c5 100644 --- a/services/nessus/README.md +++ b/services/nessus/README.md @@ -22,6 +22,6 @@ Nessus Essentials offers a free version of the tool for personal and home use, [ ## Configuration Overview -In this setup, the `tailscale-nessus` service runs Tailscale, which manages secure networking for the Nessus service. The `nessus` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Nessusā€™ web interface and scanning functionalities are only accessible through the Tailscale network (or locally, if preferred), adding an additional layer of security to your vulnerability management infrastructure. +In this setup, the `tailscale-nessus` service runs Tailscale, which manages secure networking for the Nessus service. The `nessus` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Nessusā€™ web interface and scanning functionalities are only accessible through the Tailscale network (or locally, if preferred), adding an additional layer of security to your vulnerability management infrastructure. For additional configuration (environment variables) - please refer to the [Tenable documentation](https://docs.tenable.com/nessus/Content/DeployNessusDocker.htm). diff --git a/services/netbox/.env b/services/netbox/.env index afb03ad4..323875a9 100644 --- a/services/netbox/.env +++ b/services/netbox/.env @@ -11,7 +11,8 @@ SERVICEPORT=8080 DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= // your tailscale authentication key +TS_AUTHKEY= +# your tailscale authentication key # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones @@ -63,7 +64,4 @@ POSTGRES_DB=netbox POSTGRES_PASSWORD=${SUPER_SECRET}DB POSTGRES_USER=netbox -#REDIS Environment variables -REDIS_PASSWORD=${SUPER_SECRET}REDIS - #EXAMPLE_VAR="Environment varibale" diff --git a/services/netbox/README.md b/services/netbox/README.md index 8bf32893..5e42542f 100644 --- a/services/netbox/README.md +++ b/services/netbox/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Netbox](https://github.com/netbox-com ## Configuration Overview -In this setup, the `tailscale-netbox` service runs Tailscale, which manages secure networking for the Netbox application. The `netbox` application uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that your Netbox application is only accessible through the Tailscale network (or local as well, if preferred). +In this setup, the `tailscale-netbox` service runs Tailscale, which manages secure networking for the Netbox application. The `netbox` application uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that your Netbox application is only accessible through the Tailscale network (or local as well, if preferred). diff --git a/services/netbox/compose.yaml b/services/netbox/compose.yaml index 76f49e37..11f49c52 100644 --- a/services/netbox/compose.yaml +++ b/services/netbox/compose.yaml @@ -18,7 +18,7 @@ services: environment: - TS_AUTHKEY=${TS_AUTHKEY} - TS_STATE_DIR=/var/lib/tailscale - - TS_SERVE_CONFIG=/config/serve.json # Tailsacale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required + - TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint @@ -68,7 +68,7 @@ services: timeout: 3s interval: 15s restart: always - env_file: /.env + env_file: ./.env netbox-worker: <<: *netbox container_name: worker-${SERVICE} # Name for local container management @@ -88,7 +88,7 @@ services: postgres: image: docker.io/postgres:17-alpine container_name: ${SERVICE}-postgres - env_file: /.env + env_file: ./.env healthcheck: test: pg_isready -q -t 2 -d $$POSTGRES_DB -U $$POSTGRES_USER start_period: 20s diff --git a/services/newwallpaperwhodis/.env b/services/newwallpaperwhodis/.env index c943f0c1..4bcc2b4c 100644 --- a/services/newwallpaperwhodis/.env +++ b/services/newwallpaperwhodis/.env @@ -11,7 +11,8 @@ SERVICEPORT=6767 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 diff --git a/services/next-explorer/.env b/services/next-explorer/.env index 691d23ef..e10d8890 100644 --- a/services/next-explorer/.env +++ b/services/next-explorer/.env @@ -11,7 +11,8 @@ SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables PUID=1000 @@ -23,7 +24,6 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ ACCESS_PATH=/home/root/data # Change this to the path you want to share with Tailscale. This should be an absolute path on the host machine. For example, if you want to share the /home/user/files directory, set ACCESS_PATH=/home/user/files. -TAILNET_NAME=your-tailnet-name # Change this to your Tailnet name, which is the domain you use for Tailscale. For example, if your Tailnet is "example.com", set TAILNET_NAME=example.com. SESSION_SECRET=your-super-secret # Use 'openssl rand -base64 32' in your CLI to generate a secure random key. PUBLIC_URL=https://file-explorer..ts.net # Optional: Set this to the public URL of your service if needed for correct URL generation in the app. For example, if you are exposing the service at https://example.com, set PUBLIC_URL=https://example.com. diff --git a/services/next-explorer/README.md b/services/next-explorer/README.md index 7107efde..2cf4ce39 100644 --- a/services/next-explorer/README.md +++ b/services/next-explorer/README.md @@ -8,4 +8,6 @@ This Docker Compose configuration sets up [NextExplorer](https://github.com/nxza ## Configuration Overview -In this setup, the `tailscale-files` service runs Tailscale, which manages secure networking for the NextExplorer service. The `files` service uses the Tailscale network stack via Dockerā€™s `network_mode: service:` configuration. This setup ensures that NextExplorer management interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for managing your file systems. +In this setup, the `tailscale` service runs Tailscale, which manages secure networking for NextExplorer. The `application` service uses Docker's `network_mode: service:tailscale` configuration. This keeps the management interface on your Tailnet unless you enable the optional host port mapping. + +Set `ACCESS_PATH` in `.env` to an absolute host directory before starting the stack. NextExplorer mounts that directory at `/mnt/Files`. Replace the sample `SESSION_SECRET` and `PUBLIC_URL` values with deployment-specific values when those settings are used. diff --git a/services/nodered/README.md b/services/nodered/README.md index 7f0b9abd..f7a38243 100644 --- a/services/nodered/README.md +++ b/services/nodered/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Node-RED](https://github.com/node-red ## Configuration Overview -In this setup, the `tailscale-node-red` service runs Tailscale, which manages secure networking for the Node-RED service. The `node-red` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Node-REDā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an additional layer of security and privacy for your flow-based programming environment. +In this setup, the `tailscale-node-red` service runs Tailscale, which manages secure networking for the Node-RED service. The `node-red` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Node-REDā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an additional layer of security and privacy for your flow-based programming environment. diff --git a/services/ntfy/README.md b/services/ntfy/README.md index 2cc548dd..6e3284f7 100644 --- a/services/ntfy/README.md +++ b/services/ntfy/README.md @@ -8,6 +8,6 @@ This Docker Compose configuration sets up [ntfy](https://ntfy.sh/) with Tailscal ## Configuration Overview -In this setup, the `tailscale-ntfy` service runs the Tailscale daemon to provide secure, private networking. The `ntfy` service is configured to use Tailscaleā€™s network stack via Dockerā€™s `network_mode: service:` syntax. This binds ntfyā€™s network interface to the Tailscale container, making the HTTP API available only through your Tailscale network (or locally, if needed). +In this setup, the `tailscale-ntfy` service runs the Tailscale daemon to provide secure, private networking. The `ntfy` service is configured to use Tailscaleā€™s network stack via Dockerā€™s `network_mode: service:tailscale` syntax. This binds ntfyā€™s network interface to the Tailscale container, making the HTTP API available only through your Tailscale network (or locally, if needed). This architecture is ideal for self-hosters who want to send and receive notifications from anywhere without exposing the ntfy broker to the internet, maintaining both ease of access and strict privacy controls. diff --git a/services/ollama/.env b/services/ollama/.env index 6edc7260..9df39204 100644 --- a/services/ollama/.env +++ b/services/ollama/.env @@ -11,7 +11,8 @@ SERVICEPORT=11434 # Ollama's default API port. Uncomment the "ports:" section in DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. #Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/open-webui/.env b/services/open-webui/.env index a603f9bd..e2e9e390 100644 --- a/services/open-webui/.env +++ b/services/open-webui/.env @@ -11,7 +11,8 @@ SERVICEPORT=8080 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Open WebUI Configuration # Point to your Ollama instance - can be local or remote. @@ -21,7 +22,8 @@ TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://t # Ollama over Tailnet: http://100.x.x.x:11434 # Leave blank to configure a different provider (e.g. OpenAI) via the UI. OLLAMA_BASE_URL=http://host.docker.internal:11434 -WEBUI_SECRET_KEY= # Random secret key for session security. Generate with: openssl rand -hex 32 +WEBUI_SECRET_KEY= +# Random secret key for session security. Generate with: openssl rand -hex 32 TZ=Europe/Amsterdam # Timezone for the container. #EXAMPLE_VAR="Environment varibale" diff --git a/services/open-webui/README.md b/services/open-webui/README.md index 3ee50cdf..3ba958cb 100644 --- a/services/open-webui/README.md +++ b/services/open-webui/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [Open WebUI](https://openwebui.com/) w ## Configuration Overview -In this setup, the `tailscale-open-webui` service runs Tailscale, which manages secure networking for Open WebUI. The `open-webui` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. +In this setup, the `tailscale-open-webui` service runs Tailscale, which manages secure networking for Open WebUI. The `open-webui` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. ## What to document for users diff --git a/services/paperless/.env b/services/paperless/.env index 3b314f0b..381b8adb 100644 --- a/services/paperless/.env +++ b/services/paperless/.env @@ -11,7 +11,8 @@ SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/paperless/README.md b/services/paperless/README.md index 1cadb1cf..adc2d7b5 100644 --- a/services/paperless/README.md +++ b/services/paperless/README.md @@ -8,6 +8,6 @@ This Docker Compose configuration sets up [Paperless-ngx](https://docs.paperless ## Configuration Overview -In this setup, the `tailscale-paperless` service runs the Tailscale daemon to provide secure, private networking. The `paperless` service is configured to use Tailscaleā€™s network stack via Dockerā€™s `network_mode: service:` syntax. This binds Paperless network interface to the Tailscale container, making the service available only through your Tailscale network (or locally, if needed). +In this setup, the `tailscale-paperless` service runs the Tailscale daemon to provide secure, private networking. The `paperless` service is configured to use Tailscaleā€™s network stack via Dockerā€™s `network_mode: service:tailscale` syntax. This binds Paperless network interface to the Tailscale container, making the service available only through your Tailscale network (or locally, if needed). This architecture is ideal for self-hosters who want to send and receive notifications from anywhere without exposing Paperless-ngx to the internet, maintaining both ease of access and strict privacy controls. diff --git a/services/picard/.env b/services/picard/.env index a46ce7ef..405227b5 100644 --- a/services/picard/.env +++ b/services/picard/.env @@ -11,7 +11,8 @@ SERVICEPORT=5800 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/picard/README.md b/services/picard/README.md index ade3554b..01c99d95 100644 --- a/services/picard/README.md +++ b/services/picard/README.md @@ -34,7 +34,7 @@ With this setup, your tagging process is secured and contained ā€” perfect for p In this deployment, a **Tailscale sidecar container** (for example `tailscale-picard`) connects your Picard instance to your private Tailnet. The main `picard` container uses: ```plain -network_mode: service:tailscale-picard +network_mode: service:tailscale ``` This means all Picard traffic ā€” web interface, plugin updates, and library calls ā€” travels securely through Tailscale. diff --git a/services/pihole/README.md b/services/pihole/README.md index 5ab4bd2d..d2292210 100644 --- a/services/pihole/README.md +++ b/services/pihole/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [Pi-hole](https://github.com/pi-hole/p ## Configuration Overview -In this setup, the `tailscale-pihole` service runs Tailscale, which manages secure networking for the Pi-hole service. The `pihole` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Pi-holeā€™s DNS service and web interface are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your network-wide ad blocker. +In this setup, the `tailscale-pihole` service runs Tailscale, which manages secure networking for the Pi-hole service. The `pihole` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Pi-holeā€™s DNS service and web interface are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your network-wide ad blocker. ## Binding to your local host machine? Port 53 - DNSStubListener diff --git a/services/pingvin-share/README.md b/services/pingvin-share/README.md index 382408b6..d9c2729f 100644 --- a/services/pingvin-share/README.md +++ b/services/pingvin-share/README.md @@ -10,4 +10,4 @@ This Docker Compose configuration sets up [Pingvin Share](https://github.com/sto ## Configuration Overview -In this setup, the `tailscale-pingvin` service runs Tailscale, which manages secure networking for the Pingvin Share service. The `pingvin-share` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Pingvin Shareā€™s web interface and file-sharing capabilities are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted file-sharing needs. +In this setup, the `tailscale-pingvin` service runs Tailscale, which manages secure networking for the Pingvin Share service. The `pingvin-share` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Pingvin Shareā€™s web interface and file-sharing capabilities are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted file-sharing needs. diff --git a/services/plex/README.md b/services/plex/README.md index e9712a3c..efc54976 100644 --- a/services/plex/README.md +++ b/services/plex/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Plex Media Server](https://hub.docker ## Configuration Overview -In this setup, the `tailscale-plex` service runs Tailscale, which manages secure networking for the Plex Media Server. The `plex` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Plex's media streaming service is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your media server. +In this setup, the `tailscale-plex` service runs Tailscale, which manages secure networking for the Plex Media Server. The `plex` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Plex's media streaming service is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your media server. diff --git a/services/pocket-id/README.md b/services/pocket-id/README.md index 59df32a0..8722cbb0 100644 --- a/services/pocket-id/README.md +++ b/services/pocket-id/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up [Pocket ID](https://github.com/stonith ## Configuration Overview -In this setup, the `tailscale-pocket-id` service runs Tailscale, which manages secure networking for the Pocket ID service. The `pocket-id` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Pocket IDā€™s web interface and APIs are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your identity management system. +In this setup, the `tailscale-pocket-id` service runs Tailscale, which manages secure networking for the Pocket ID service. The `pocket-id` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Pocket IDā€™s web interface and APIs are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your identity management system. diff --git a/services/portainer/README.md b/services/portainer/README.md index 03146cc6..893de772 100644 --- a/services/portainer/README.md +++ b/services/portainer/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Portainer](https://github.com/portain ## Configuration Overview -In this setup, the `tailscale-portainer` service runs Tailscale, which manages secure networking for the Portainer service. The `portainer` service uses the Tailscale network stack via Dockerā€™s `network_mode: service:` configuration. This setup ensures that Portainerā€™s management interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for managing your Docker environments. +In this setup, the `tailscale-portainer` service runs Tailscale, which manages secure networking for the Portainer service. The `portainer` service uses the Tailscale network stack via Dockerā€™s `network_mode: service:tailscale` configuration. This setup ensures that Portainerā€™s management interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for managing your Docker environments. diff --git a/services/portracker/README.md b/services/portracker/README.md index 3461ace3..257d9589 100644 --- a/services/portracker/README.md +++ b/services/portracker/README.md @@ -19,4 +19,4 @@ With Tailscale in place, all of these features are securely tunneled through you ## Configuration Overview -In this setup, the `tailscale-portracker` service runs Tailscale, which handles the secure networking layer. The `portracker` service uses Dockerā€™s `network_mode: service:` setting to share the network stack of the Tailscale container. This means the Portracker web interface and all monitoring functionality are only accessible via the Tailscale network (or locally if preferred), adding a strong privacy layer to your self-hosted port tracker. +In this setup, the `tailscale-portracker` service runs Tailscale, which handles the secure networking layer. The `portracker` service uses Dockerā€™s `network_mode: service:tailscale` setting to share the network stack of the Tailscale container. This means the Portracker web interface and all monitoring functionality are only accessible via the Tailscale network (or locally if preferred), adding a strong privacy layer to your self-hosted port tracker. diff --git a/services/posterizarr/README.md b/services/posterizarr/README.md index dce5b71b..ad797d98 100644 --- a/services/posterizarr/README.md +++ b/services/posterizarr/README.md @@ -31,7 +31,7 @@ This approach is ideal for homelabs, media servers, and multi-location setups wh In this deployment, a **Tailscale sidecar container** (for example, `tailscale-posterizarr`) runs the Tailscale client and connects to your private Tailscale network. The Posterizarr service uses: ```plain -network_mode: service:tailscale-posterizarr +network_mode: service:tailscale ``` This configuration ensures that **all Posterizarr traffic is routed exclusively through the Tailscale interface**, allowing it to securely communicate with Radarr and Sonarr instances over your private network. No ports are exposed to the public Internet, and the service remains fully isolated. diff --git a/services/prowlarr/README.md b/services/prowlarr/README.md index 1bb1892f..ba0c486c 100644 --- a/services/prowlarr/README.md +++ b/services/prowlarr/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Prowlarr](https://github.com/Prowlarr ## Configuration Overview -In this setup, the `tailscale-prowlarr` service runs Tailscale, which manages secure networking for the Prowlarr service. The `prowlarr` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Prowlarrā€™s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted indexer manager. +In this setup, the `tailscale-prowlarr` service runs Tailscale, which manages secure networking for the Prowlarr service. The `prowlarr` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Prowlarrā€™s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted indexer manager. diff --git a/services/qbittorrent/README.md b/services/qbittorrent/README.md index df90fb3e..529520ad 100644 --- a/services/qbittorrent/README.md +++ b/services/qbittorrent/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [qBittorrent](https://www.qbittorrent. ## Configuration Overview -In this setup, the tailscale-qbittorrent service runs Tailscale, which manages secure networking for the qBittorrent service. The qbittorrent service uses the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that qBittorrentā€™s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted torrent client. +In this setup, the tailscale-qbittorrent service runs Tailscale, which manages secure networking for the qBittorrent service. The qbittorrent service uses the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that qBittorrentā€™s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted torrent client. diff --git a/services/radarr/README.md b/services/radarr/README.md index 062c6fbe..fad9e8e6 100644 --- a/services/radarr/README.md +++ b/services/radarr/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [Radarr](https://github.com/Radarr/Rad ## Configuration Overview -In this setup, the `tailscale-radarr` service runs Tailscale, which manages secure networking for the Radarr service. The `radarr` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Radarrā€™s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted media manager. +In this setup, the `tailscale-radarr` service runs Tailscale, which manages secure networking for the Radarr service. The `radarr` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Radarrā€™s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted media manager. ### Trouble with presets or optimal download quality, try diff --git a/services/radicale/README.md b/services/radicale/README.md index 7121b99d..981e3c2f 100644 --- a/services/radicale/README.md +++ b/services/radicale/README.md @@ -17,7 +17,7 @@ This Docker Compose configuration sets up [Radicale](https://radicale.org/) with ## Configuration Overview -In this setup, the `tailscale-radicale` service runs Tailscale, which manages secure networking for Radicale. The `radicale` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. +In this setup, the `tailscale-radicale` service runs Tailscale, which manages secure networking for Radicale. The `radicale` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. The container runs with hardened security settings: read-only filesystem, no new privileges, dropped capabilities, and resource limits (256M memory, 50 pids). diff --git a/services/recyclarr/README.md b/services/recyclarr/README.md index a0b5fa4e..2b41ef62 100644 --- a/services/recyclarr/README.md +++ b/services/recyclarr/README.md @@ -31,7 +31,7 @@ This is especially valuable in homelabs, seedbox setups, or multi-location media In this deployment, a **Tailscale sidecar container** (for example, `tailscale-recyclarr`) runs the Tailscale client and joins your private Tailscale network. The Recyclarr service uses: ```plain -network_mode: service:tailscale-recyclarr +network_mode: service:tailscale ``` This setup ensures that **all Recyclarr traffic flows exclusively through the Tailscale interface**, allowing it to securely reach Radarr and Sonarr instances that are also on your Tailscale network. No ports need to be exposed, and the container remains completely inaccessible from the public Internet. diff --git a/services/resilio-sync/README.md b/services/resilio-sync/README.md index f79247d9..1806c34a 100644 --- a/services/resilio-sync/README.md +++ b/services/resilio-sync/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Resilio Sync](https://github.com/linu ## Configuration Overview -In this setup, the `tailscale-resilio-sync` service runs Tailscale, which manages secure networking for the Resilio Sync service. The `resilio-sync` service uses the Tailscale network stack via Dockerā€™s `network_mode: service:` configuration. This setup ensures that Resilio Sync is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your file synchronization and sharing tasks. +In this setup, the `tailscale-resilio-sync` service runs Tailscale, which manages secure networking for the Resilio Sync service. The `resilio-sync` service uses the Tailscale network stack via Dockerā€™s `network_mode: service:tailscale` configuration. This setup ensures that Resilio Sync is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your file synchronization and sharing tasks. diff --git a/services/rustdesk-server/.env b/services/rustdesk-server/.env index 967a33db..f5616f25 100644 --- a/services/rustdesk-server/.env +++ b/services/rustdesk-server/.env @@ -11,7 +11,8 @@ SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 diff --git a/services/rustdesk-server/README.md b/services/rustdesk-server/README.md index 36fce958..a132c3c1 100644 --- a/services/rustdesk-server/README.md +++ b/services/rustdesk-server/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [Rustdesk Server](https://rustdesk.com ## Configuration Overview -In this setup, the `tailscale-rustdesk-server` service runs Tailscale, which manages secure networking for Rustdesk Server. The `Rustdesk Server` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. +In this setup, the `tailscale-rustdesk-server` service runs Tailscale, which manages secure networking for Rustdesk Server. The `Rustdesk Server` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. ## Client setup diff --git a/services/seafile/.env b/services/seafile/.env index b3e65a84..759e90bc 100644 --- a/services/seafile/.env +++ b/services/seafile/.env @@ -3,17 +3,19 @@ #COMPOSE_PROJECT_NAME= # Optional: only use when running multiple deployments on the same infrastructure. # Service Configuration -SERVICE= seafile # Service name (e.g., adguard). Used as hostname in Tailscale and for container naming (app-${SERVICE}). +SERVICE=seafile # Service name (e.g., adguard). Used as hostname in Tailscale and for container naming (app-${SERVICE}). SEAFILE_IMAGE=seafileltd/seafile-mc:13.0-latest # Docker image URL from container registry (e.g., adguard/adguard-home). SEAFILE_DB_IMAGE=mariadb:10.11 SEAFILE_MEMCACHED_IMAGE=memcached:1.6.29 # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 @@ -31,7 +33,8 @@ INIT_SEAFILE_MYSQL_ROOT_PASSWORD=REPLACE_WITH_RANDOM_ALPHANUMERIC_PASSWORD SEAFILE_MYSQL_DB_USER=seafile SEAFILE_MYSQL_DB_PASSWORD=REPLACE_WITH_RANDOM_ALPHANUMERIC_PASSWORD TIME_ZONE=Etc/UTC -JWT_PRIVATE_KEY= #A random string with a length of no less than 32 characters, generate example: pwgen -s 40 1 or use openssl rand -base64 40 +JWT_PRIVATE_KEY= +#A random string with a length of no less than 32 characters, generate example: pwgen -s 40 1 or use openssl rand -base64 40 SEAFILE_SERVER_HOSTNAME=seafile..ts.net # update with specific MagicDNS suffix SEAFILE_SERVER_PROTOCOL=https INIT_SEAFILE_ADMIN_EMAIL= ADD_EMAIL_ADDRESS_HERE @@ -40,4 +43,4 @@ ENABLE_SEADOC=false ENABLE_NOTIFICATION_SERVER=false CACHE_PROVIDER=memcached MEMCACHED_HOST=app-seafile-memcached -MEMCACHED_PORT=11211 \ No newline at end of file +MEMCACHED_PORT=11211 diff --git a/services/seafile/README.md b/services/seafile/README.md index 242255e8..ace91f5c 100644 --- a/services/seafile/README.md +++ b/services/seafile/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [Seafile Community Edition](https://ww ## Configuration Overview -In this setup, the `tailscale-seafile` service runs Tailscale, which manages secure networking for Seafile. The Seafile service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. +In this setup, the `tailscale-seafile` service runs Tailscale, which manages secure networking for Seafile. The Seafile service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. ## Notes diff --git a/services/searxng/.env b/services/searxng/.env index 6eabe229..f2fbf62f 100644 --- a/services/searxng/.env +++ b/services/searxng/.env @@ -20,7 +20,8 @@ TAILNET_NAME= # Optional Service variables # PUID=1000 -SEARXNG_SECRET= # Generate a random secret for searxng, e.g. using `openssl rand -hex 32` +SEARXNG_SECRET= +# Generate a random secret for searxng, e.g. using `openssl rand -hex 32` SEARXNG_VALKEY_URL=valkey://valkey-searxng:6379/0 # URL for valkey, format: valkey://:/ #EXAMPLE_VAR="Environment varibale" diff --git a/services/searxng/README.md b/services/searxng/README.md index a9d8f9a6..c0690c55 100644 --- a/services/searxng/README.md +++ b/services/searxng/README.md @@ -8,10 +8,11 @@ This Docker Compose configuration sets up [searXNG](https://github.com/searxng/s ## Configuration Overview -In this setup, the `tailscale-searxng` service runs Tailscale, which manages secure networking for the searXNG service. The `searxng` service utilizes the Tailscale network stack via Dockerā€™s `network_mode: service:` configuration. This setup ensures that searXNG is only accessible through your Tailscale network (or locally, if preferred). With this configuration, you can enjoy a private, secure, and customizable search engine experience, free from user tracking or external access. +In this setup, the `tailscale-searxng` service runs Tailscale, which manages secure networking for the searXNG service. The `searxng` service utilizes the Tailscale network stack via Dockerā€™s `network_mode: service:tailscale` configuration. This setup ensures that searXNG is only accessible through your Tailscale network (or locally, if preferred). With this configuration, you can enjoy a private, secure, and customizable search engine experience, free from user tracking or external access. We use `/searxng/settings.yml` copied from as the default settings file. This dir is mounted as a volume, on docker and required for the first run. The default `settings.yml` does not use valkey ([valkey](https://github.com/searxng/searxng/blob/master/searx/settings.yml#L121) URL is set to `false`). We enable this by setting the `SEARXNG_VALKEY_URL` in `.env` file and using that in the `compose.yaml` file. +Set `SEARXNG_SECRET` in `.env` to a random value. The Compose file passes it to the mounted settings file as the instance secret. ## References diff --git a/services/searxng/compose.yaml b/services/searxng/compose.yaml index 639004cf..6d8ef7a6 100644 --- a/services/searxng/compose.yaml +++ b/services/searxng/compose.yaml @@ -56,6 +56,7 @@ services: - PUID=1000 - PGID=1000 - SEARXNG_BASE_URL=https://${SERVICE}.${TAILNET_NAME}.ts.net/ + - SEARXNG_SECRET=${SEARXNG_SECRET} - SEARXNG_VALKEY_URL=${SEARXNG_VALKEY_URL} - TZ=${TZ} volumes: diff --git a/services/seerr/README.md b/services/seerr/README.md index a778eb0f..6bc376aa 100644 --- a/services/seerr/README.md +++ b/services/seerr/README.md @@ -8,6 +8,6 @@ This Docker Compose configuration sets up [Seerr](https://github.com/seerr-team/ ## Configuration Overview -In this setup, the `tailscale-seerr` service runs the Tailscale daemon to provide secure, private networking. The `seerr` service is configured to use Tailscaleā€™s network stack via Dockerā€™s `network_mode: service:` syntax. This binds Seerā€™s network interface to the Tailscale container, making the web UI and API available only through your Tailscale network (or locally, if needed). +In this setup, the `tailscale-seerr` service runs the Tailscale daemon to provide secure, private networking. The `seerr` service is configured to use Tailscaleā€™s network stack via Dockerā€™s `network_mode: service:tailscale` syntax. This binds Seerā€™s network interface to the Tailscale container, making the web UI and API available only through your Tailscale network (or locally, if needed). This architecture is ideal for self-hosters who want to access Seerr from anywhere without exposing it to the internet, maintaining both ease of access and strict privacy controls. diff --git a/services/slink/README.md b/services/slink/README.md index 6442221d..571111f4 100644 --- a/services/slink/README.md +++ b/services/slink/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Slink](https://github.com/andrii-kryv ## Configuration Overview -In this setup, the `tailscale-slink` service runs Tailscale, which manages secure networking for the Slink service. The `slink` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Slink's file-sharing interface is only accessible through the Tailscale network, adding an extra layer of security and privacy for your self-hosted file-sharing system. +In this setup, the `tailscale-slink` service runs Tailscale, which manages secure networking for the Slink service. The `slink` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Slink's file-sharing interface is only accessible through the Tailscale network, adding an extra layer of security and privacy for your self-hosted file-sharing system. diff --git a/services/sonarr/README.md b/services/sonarr/README.md index c960287b..3c6cfa9a 100644 --- a/services/sonarr/README.md +++ b/services/sonarr/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [Sonarr](https://github.com/Sonarr/Son ## Configuration Overview -In this setup, the tailscale-sonarr service runs Tailscale, which manages secure networking for the Sonarr service. The sonarr service uses the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that Sonarrā€™s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted media manager. +In this setup, the tailscale-sonarr service runs Tailscale, which manages secure networking for the Sonarr service. The sonarr service uses the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that Sonarrā€™s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted media manager. ### Trouble with presets or optimal download quality, try diff --git a/services/speedtest-tracker/README.md b/services/speedtest-tracker/README.md index e571bb07..b14766ce 100644 --- a/services/speedtest-tracker/README.md +++ b/services/speedtest-tracker/README.md @@ -15,4 +15,4 @@ This Docker Compose configuration sets up [Speedtest Tracker](https://github.com ## Configuration Overview -In this setup, the `tailscale-speedtest` service runs Tailscale, which manages secure networking for the Speedtest Tracker service. The `speedtest-tracker` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Speedtest Trackerā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for your internet speed monitoring. +In this setup, the `tailscale-speedtest` service runs Tailscale, which manages secure networking for the Speedtest Tracker service. The `speedtest-tracker` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Speedtest Trackerā€™s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for your internet speed monitoring. diff --git a/services/stirlingpdf/README.md b/services/stirlingpdf/README.md index c3d6a734..122268a1 100644 --- a/services/stirlingpdf/README.md +++ b/services/stirlingpdf/README.md @@ -8,4 +8,4 @@ Stirling-PDF is a versatile, open-source toolkit that allows you to perform vari ## Configuration Overview -In this setup, the `tailscale-stirlingpdf` service runs Tailscale, which manages secure networking for the Stirling-PDF service. The `stirlingpdf` service uses the Tailscale network stack via Dockerā€™s `network_mode: service:` configuration. This setup ensures that Stirling-PDF's interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your PDF processing tasks. +In this setup, the `tailscale-stirlingpdf` service runs Tailscale, which manages secure networking for the Stirling-PDF service. The `stirlingpdf` service uses the Tailscale network stack via Dockerā€™s `network_mode: service:tailscale` configuration. This setup ensures that Stirling-PDF's interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your PDF processing tasks. diff --git a/services/subtrackr/README.md b/services/subtrackr/README.md index aedd00ec..87a6a263 100644 --- a/services/subtrackr/README.md +++ b/services/subtrackr/README.md @@ -18,4 +18,4 @@ This Docker Compose configuration sets up [**Subtrackr**](https://github.com/bsc ## Configuration Overview -In this deployment, the `tailscale-subtrackr` service runs the Tailscale client to establish a secure private network. The `subtrackr` container uses `network_mode: service:tailscale-subtrackr` to route all traffic through the Tailscale interface. This ensures that your subscription data, dashboards, and administration interface are only accessible via Tailscale, preventing public exposure. +In this deployment, the `tailscale-subtrackr` service runs the Tailscale client to establish a secure private network. The `subtrackr` container uses `network_mode: service:tailscale` to route all traffic through the Tailscale interface. This ensures that your subscription data, dashboards, and administration interface are only accessible via Tailscale, preventing public exposure. diff --git a/services/sure/.env b/services/sure/.env index 0cd788e3..df561f55 100755 --- a/services/sure/.env +++ b/services/sure/.env @@ -11,7 +11,8 @@ SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 @@ -33,17 +34,19 @@ POSTGRES_HOST=db # Used by the backup service (on sure_net, Docker DNS works) REDIS_URL=redis://172.28.0.11:6379/1 # Static IP of redis on sure_net (web/worker share tailscale namespace where Docker DNS is overridden by MagicDNS) # Sure Application -SECRET_KEY_BASE= #openssl rand -hex 64 +SECRET_KEY_BASE= +#openssl rand -hex 64 SELF_HOSTED=true RAILS_FORCE_SSL=true RAILS_ASSUME_SSL=true -PORT=8070 # OpenAI (Optional) -OPENAI_ACCESS_TOKEN= # NOTE: enabling OpenAI will incur costs when you use AI-related features in the app (chat, rules) +OPENAI_ACCESS_TOKEN= +# NOTE: enabling OpenAI will incur costs when you use AI-related features in the app (chat, rules) # OIDC Authentication (Optional) -OIDC_ISSUER= # OIDC issuer URL for authentication +OIDC_ISSUER= +# OIDC issuer URL for authentication OIDC_CLIENT_ID= OIDC_CLIENT_SECRET= OIDC_REDIRECT_URI=https:///auth/openid_connect/callback diff --git a/services/swingmx/README.md b/services/swingmx/README.md index e00fff95..a365b8d2 100644 --- a/services/swingmx/README.md +++ b/services/swingmx/README.md @@ -27,7 +27,9 @@ Self-hosting Swing Music gives you **full ownership of your music library**, com In this deployment, a **Tailscale sidecar container** (for example `tailscale-swingmusic`) runs the Tailscale client and joins your private Tailscale network. The main `swingmusic` service uses: ```plain -network_mode: service:tailscale-swingmusic +network_mode: service:tailscale ``` This configuration routes all traffic through the Tailscale interface, ensuring the Swing Music web UI and streaming endpoints are accessible **only via your Tailscale network**. This keeps your music library secure while allowing seamless access from all your trusted devices. + +Before starting the stack, replace `/path/to/music` in `compose.yaml` with the absolute host directory that contains your music library. diff --git a/services/tailscale-app-connector-node/.env b/services/tailscale-app-connector-node/.env index cc1b9d25..0b319780 100644 --- a/services/tailscale-app-connector-node/.env +++ b/services/tailscale-app-connector-node/.env @@ -7,7 +7,8 @@ SERVICE=app-connector IMAGE_URL=tailscale/tailscale # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Tailscale Configuration diff --git a/services/tailscale-exit-node/.env b/services/tailscale-exit-node/.env index d18f2142..d6b88a54 100644 --- a/services/tailscale-exit-node/.env +++ b/services/tailscale-exit-node/.env @@ -7,7 +7,8 @@ SERVICE=exit-node IMAGE_URL=tailscale/tailscale # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Tailscale Configuration diff --git a/services/tailscale-subnet-router-node/.env b/services/tailscale-subnet-router-node/.env index ef054713..dbe219de 100644 --- a/services/tailscale-subnet-router-node/.env +++ b/services/tailscale-subnet-router-node/.env @@ -7,7 +7,8 @@ SERVICE=subnet-router IMAGE_URL=tailscale/tailscale # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Tailscale Configuration diff --git a/services/tandoor/README.md b/services/tandoor/README.md index 5eb9ec92..d6136245 100644 --- a/services/tandoor/README.md +++ b/services/tandoor/README.md @@ -15,4 +15,4 @@ This Docker Compose configuration sets up [**Tandoor Recipes**](https://github.c ## Configuration Overview -In this setup, the `tailscale-tandoor` service runs Tailscale, which manages secure networking for the service. The `tandoor` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale-tandoor` configuration. This setup ensures that tandoor's service is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your service. +In this setup, the `tailscale-tandoor` service runs Tailscale, which manages secure networking for the service. The `tandoor` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that tandoor's service is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your service. diff --git a/services/tautulli/README.md b/services/tautulli/README.md index fd5c5125..a8bc9bc2 100644 --- a/services/tautulli/README.md +++ b/services/tautulli/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Tautulli for Docker](https://hub.dock ## Configuration Overview -In this setup, the tailscale-tautulli service runs Tailscale, which manages secure networking for the Tautulli service. The tautulli service utilizes the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that Tautulliā€™s monitoring interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your Plex server monitoringĀ andĀ management. +In this setup, the tailscale-tautulli service runs Tailscale, which manages secure networking for the Tautulli service. The tautulli service utilizes the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that Tautulliā€™s monitoring interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your Plex server monitoringĀ andĀ management. diff --git a/services/tracktor/.env b/services/tracktor/.env index a95d0512..bbc9c71d 100644 --- a/services/tracktor/.env +++ b/services/tracktor/.env @@ -11,11 +11,13 @@ SERVICEPORT=3333 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones -TS_TAILNET= # Your Tailscale tailnet name (e.g., my-tailnet). +TS_TAILNET= +# Your Tailnet DNS name without .ts.net (e.g., tail123abc). # Optional Service variables # PUID=1000 diff --git a/services/tracktor/README.md b/services/tracktor/README.md index 3ef7c199..b6e6934c 100644 --- a/services/tracktor/README.md +++ b/services/tracktor/README.md @@ -30,7 +30,11 @@ When combined with Tailscale, Tracktor becomes a private portal accessible only In this deployment, a **Tailscale sidecar container** (for example `tailscale-tracktor`) runs the Tailscale client and joins your private Tailscale network. The main `tracktor` service uses: ```plain -network_mode: service:tailscale-tracktor +network_mode: service:tailscale ``` This configuration routes all inbound and outbound traffic through the Tailscale interface, ensuring that the Tracktor web UI is accessible **only via your Tailscale network**. + +Set `TS_TAILNET` in `.env` to your Tailnet DNS name without `.ts.net`, for example `tail123abc`. Compose appends `.ts.net` to build the allowed browser origin, such as `https://tracktor.tail123abc.ts.net`. + +If you enable the optional host port mapping, it maps `SERVICEPORT` to Tracktor's container port `3000`. diff --git a/services/tracktor/compose.yaml b/services/tracktor/compose.yaml index aa68c51e..c16df74f 100644 --- a/services/tracktor/compose.yaml +++ b/services/tracktor/compose.yaml @@ -35,7 +35,7 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:3000 # Binding the host port to Tracktor's container port # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below #dns: # - ${DNS_SERVER} @@ -55,7 +55,7 @@ services: environment: - TRACKTOR_DEMO_MODE=false - FORCE_DATA_SEED=false - - CORS_ORIGINS="https://${SERVICE}.${TS_TAILNET}.ts.net" # Adjust as needed for your setup + - CORS_ORIGINS=https://${SERVICE}.${TS_TAILNET}.ts.net # Adjust as needed for your setup volumes: - ./${SERVICE}-data:/data depends_on: diff --git a/services/traefik/README.md b/services/traefik/README.md index 054ea7a6..c0bd6287 100644 --- a/services/traefik/README.md +++ b/services/traefik/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Traefik](https://github.com/traefik/t ## Configuration Overview -In this setup, the `tailscale-traefik` service runs Tailscale, which manages secure networking for the Traefik service. The `traefik` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Traefikā€™s dashboard and routing functionalities are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of privacy and security to your network architecture. +In this setup, the `tailscale-traefik` service runs Tailscale, which manages secure networking for Traefik. The `traefik_proxy` service uses Docker's `network_mode: service:tailscale` configuration. The stack reads its tracked configuration from `traefik/app/traefik.yml`. diff --git a/services/traefik/compose.yaml b/services/traefik/compose.yaml index ba4e6311..595598cf 100644 --- a/services/traefik/compose.yaml +++ b/services/traefik/compose.yaml @@ -68,7 +68,7 @@ services: restart: always volumes: - type: bind - source: ./${SERVICE}-data/app/traefik.yml + source: ./traefik/app/traefik.yml target: /etc/traefik.yml - ./${SERVICE}-data/log/:/var/log/ - /var/run/docker.sock:/var/run/docker.sock #Required for the Service Connections diff --git a/services/transmute/.env b/services/transmute/.env index d17b1207..ac54f9c5 100644 --- a/services/transmute/.env +++ b/services/transmute/.env @@ -11,7 +11,8 @@ SERVICEPORT=3313 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 diff --git a/services/transmute/README.md b/services/transmute/README.md index c50001c1..c4f09711 100644 --- a/services/transmute/README.md +++ b/services/transmute/README.md @@ -18,7 +18,7 @@ Running Transmute behind Tailscale ensures that your file processing pipelines a ## Configuration Overview -In this setup, the `tailscale-transmute` service runs Tailscale and manages secure connectivity to your Tailnet. The `transmute` container shares the same network stack using Dockerā€™s `network_mode: service:tailscale-transmute`. +In this setup, the `tailscale-transmute` service runs Tailscale and manages secure connectivity to your Tailnet. The `transmute` container shares the same network stack using Dockerā€™s `network_mode: service:tailscale`. ## Service Notes / Gotchas diff --git a/services/transmute/compose.yaml b/services/transmute/compose.yaml index d283b937..7d3d72e4 100644 --- a/services/transmute/compose.yaml +++ b/services/transmute/compose.yaml @@ -52,7 +52,7 @@ services: image: ${IMAGE_URL} # Image to be used network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale container_name: app-${SERVICE} # Name for local container management - environment: # Varibles are delared in .env file. + environment: # Variables are declared in .env file. - PUID=1000 - PGID=1000 - TZ=${TZ} @@ -68,4 +68,4 @@ services: timeout: 10s retries: 3 start_period: 30s - restart: always \ No newline at end of file + restart: always diff --git a/services/uptime-kuma/README.md b/services/uptime-kuma/README.md index 3a87dcf3..1b2facfb 100644 --- a/services/uptime-kuma/README.md +++ b/services/uptime-kuma/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Uptime Kuma](https://github.com/louis ## Configuration Overview -In this setup, the `tailscale-uptimekuma` service runs Tailscale, which manages secure networking for the Uptime Kuma service. The `uptimekuma` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Uptime Kuma's monitoring dashboard is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your monitoring solution. +In this setup, the `tailscale-uptimekuma` service runs Tailscale, which manages secure networking for the Uptime Kuma service. The `uptimekuma` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Uptime Kuma's monitoring dashboard is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your monitoring solution. diff --git a/services/vaultwarden/README.md b/services/vaultwarden/README.md index bc450ebe..f63339da 100644 --- a/services/vaultwarden/README.md +++ b/services/vaultwarden/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Vaultwarden](https://github.com/dani- ## Configuration Overview -In this setup, the `tailscale-vaultwarden` service runs Tailscale, which manages secure networking for the Vaultwarden service. The `vaultwarden` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Vaultwardenā€™s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted password manager. +In this setup, the `tailscale-vaultwarden` service runs Tailscale, which manages secure networking for the Vaultwarden service. The `vaultwarden` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Vaultwardenā€™s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted password manager. diff --git a/services/vikunja/.env b/services/vikunja/.env index a1601c81..a19015c6 100644 --- a/services/vikunja/.env +++ b/services/vikunja/.env @@ -11,7 +11,8 @@ SERVICEPORT=3456 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 @@ -24,4 +25,4 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim #EXAMPLE_VAR="Environment varibale" VIKUNJA_SERVICE_PUBLICURL=https://vikunja..ts.net/ -VIKUNJA_DATABASE_PATH=/db/vikunja.db # Path to the SQLite database file. Ensure this path is correctly mapped in your Docker volumes.a \ No newline at end of file +VIKUNJA_DATABASE_PATH=/db/vikunja.db # Path to the SQLite database file. Ensure this path is correctly mapped in your Docker volumes.a diff --git a/services/vikunja/README.md b/services/vikunja/README.md index 0172ab44..74f547a2 100644 --- a/services/vikunja/README.md +++ b/services/vikunja/README.md @@ -19,7 +19,7 @@ Vikunja is ideal for individuals or teams who want full ownership of their produ ## Configuration Overview -In this setup, the `tailscale-vikunja` service runs Tailscale, which manages secure networking for Vikunja. The `vikunja` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures the application is only accessible through your Tailnet unless you explicitly expose ports. +In this setup, the `tailscale-vikunja` service runs Tailscale, which manages secure networking for Vikunja. The `vikunja` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures the application is only accessible through your Tailnet unless you explicitly expose ports. ### Service-Specific Notes diff --git a/services/vikunja/compose.yaml b/services/vikunja/compose.yaml index b5b4abd2..53eee906 100644 --- a/services/vikunja/compose.yaml +++ b/services/vikunja/compose.yaml @@ -53,7 +53,7 @@ services: network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale container_name: app-${SERVICE} # Name for local container management user: "0:0" - environment: # Varibles are delared in .env file. + environment: # Variables are declared in .env file. - TZ=${TZ} - VIKUNJA_SERVICE_PUBLICURL=${VIKUNJA_SERVICE_PUBLICURL} - VIKUNJA_DATABASE_PATH=${VIKUNJA_DATABASE_PATH} @@ -64,4 +64,4 @@ services: depends_on: tailscale: condition: service_healthy - restart: always \ No newline at end of file + restart: always diff --git a/services/wallos/README.md b/services/wallos/README.md index b86c3a30..36e421d8 100644 --- a/services/wallos/README.md +++ b/services/wallos/README.md @@ -17,6 +17,6 @@ Wallos is a self-hosted subscription tracking application that helps you manage ## Configuration Overview -In this configuration, the `tailscale-wallos` container runs the Tailscale client and joins your private mesh network. The `wallos` container is set to use `network_mode: service:tailscale-wallos`, meaning all of Wallosā€™s network traffic is routed through the Tailscale container. This ensures that the Wallos interface is not publicly exposed and is only reachable from devices connected to your Tailscale network. +In this configuration, the `tailscale-wallos` container runs the Tailscale client and joins your private mesh network. The `wallos` container is set to use `network_mode: service:tailscale`, meaning all of Wallosā€™s network traffic is routed through the Tailscale container. This ensures that the Wallos interface is not publicly exposed and is only reachable from devices connected to your Tailscale network. This approach combines self-hosted financial tracking with robust, zero-config VPN securityā€”allowing you to safely manage your subscriptions from anywhere. diff --git a/services/xwiki/.env b/services/xwiki/.env index c5af4187..a63f2893 100644 --- a/services/xwiki/.env +++ b/services/xwiki/.env @@ -7,11 +7,12 @@ SERVICE=xwiki # Service name (e.g., adguard). Used as hostname in Tailscale and IMAGE_URL=xwiki:stable-mariadb-tomcat # Docker image URL from container registry (e.g., adguard/adguard-home). # Network Configuration -SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT=8080 # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/xwiki/compose.yml b/services/xwiki/compose.yml index 8e919ca6..2384bc39 100644 --- a/services/xwiki/compose.yml +++ b/services/xwiki/compose.yml @@ -57,7 +57,7 @@ services: condition: service_healthy db: condition: service_started - environment: # Varibles are delared in .env file. + environment: # Variables are declared in .env file. - XWIKI_VERSION=${XWIKI_VERSION} - DB_USER=${DB_USER} - DB_PASSWORD=${DB_PASSWORD} diff --git a/templates/service-template/.env b/templates/service-template/.env index ad96b14c..8e80ebab 100644 --- a/templates/service-template/.env +++ b/templates/service-template/.env @@ -3,15 +3,19 @@ #COMPOSE_PROJECT_NAME= # Optional: only use when running multiple deployments on the same infrastructure. # Service Configuration -SERVICE= # Service name (e.g., adguard). Used as hostname in Tailscale and for container naming (app-${SERVICE}). -IMAGE_URL= # Docker image URL from container registry (e.g., adguard/adguard-home). +SERVICE= +# Service name (e.g., adguard). Used as hostname in Tailscale and for container naming (app-${SERVICE}). +IMAGE_URL= +# Docker image URL from container registry (e.g., adguard/adguard-home). # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 diff --git a/templates/service-template/README.md b/templates/service-template/README.md index 58af12c9..719f454c 100644 --- a/templates/service-template/README.md +++ b/templates/service-template/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [SERVICE](LINK TO PAGE OF MAINTAINER) ## Configuration Overview -In this setup, the `tailscale-SERVICE` service runs Tailscale, which manages secure networking for SERVICE. The `SERVICE` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. +In this setup, the `tailscale-SERVICE` container runs Tailscale, which manages secure networking for SERVICE. The `SERVICE` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. ## What to document for users diff --git a/templates/service-template/compose.yaml b/templates/service-template/compose.yaml index 03fd6370..c4f20953 100644 --- a/templates/service-template/compose.yaml +++ b/templates/service-template/compose.yaml @@ -52,7 +52,7 @@ services: image: ${IMAGE_URL} # Image to be used network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale container_name: app-${SERVICE} # Name for local container management - environment: # Varibles are delared in .env file. + environment: # Variables are declared in .env file. - PUID=1000 - PGID=1000 - TZ=${TZ}