↓Skip to main content

Running a service behind Tailscale and Caddy reverse proxy using Docker Compose

Docker Tailscale Wireguard Caddy Reverse Proxy Homelab

I would like to share a service on my homelab with other users.

flowchart LR; A[Internet] <-- "http:// my-service.my-tailscale-network.ts.net:8585" --> B[Tailscale] B <--> C[Service]

A basic setup is to run the service along with Tailscale in Docker Compose. If the service runs on port 8585, then it is reachable at “http://my-service.my-tailscale-network.ts.net:8585”.

There are two annoyances with this setup. First, the port number is not easy to remember, nor is it conventional. Second, it is not running HTTPS or the domain certificate is invalid. I would like the service be reachable at “https://my-service.my-tailscale-network.ts.net” and the browser will see a valid domain certificate.

flowchart LR; A[Internet] <-- "https:// my-service.my-tailscale-network.ts.net" --> B[Tailscale] B <--> C[Caddy] C <--> D[Service]

Adding Caddy as a reverse proxy solves both annoyances. First, the port number is no longer needed as Caddy port forwards as a reverse proxy. Second, Caddy recognizes “*.ts.net” URLs as Tailscale and will “fetch” valid certificates from Tailscale.

Code is available.

References: