Containers + TLS Certificate Help

[Lapras]

Trying to implement TSDProxy with a docker compose for a homelab. I am trying to host two services (for now) on a docker compose on my desktop that are made available through tailscale. Pihole, and Portainer. I can get the containers activated and TSDProxy adds the machines to my tailscale. However, I cannot reach these containers at all through HTTP (except for through localhost). I'm getting the foillowing error from TSDProxy in the docker compose
tsdproxy | 2025/01/16 22:14:49 http: TLS handshake error from 100.127.93.107:62706: no SNI ServerName

Not really sure how I can fix this. The IP displayed is the IP of my desktop in tailscale. Has anyone encountered similar problems?

[stevetrease]

TSDproxy will have created a new device for each container which will be visible in your Tailscale console.
Are you connecting using the Tailscale FQDN (ie host.funnyname.ts.net) or the Tailscale IP?

[Lapras]

Tailscale is properly registering a new device for every container. However I cannot connect to any of them, either through the IP or FQDN.

[stevetrease]

You say desktop, I’ve had difficulties getting TSDproxy to work using Docker on MacOS. What OS are you using?

Maybe some things to try in this thread? #43

[Lapras]

this is just windows 11

[stevetrease]

Sorry, not tried TSDProxy (or Docker) in Windows.

[stevetrease]

Another thought: tsdproxy automatically publishes the lowest port from the container. In the case of pihole that will probably be port 53 (dns). You probably need to use the tsdproxy.container_port: label to specify the port used by the pihole gui.

[almeidapaulopt]

is your containers using a https port? see this

example my portainer:
labels:
tsdproxy.enable: "true"
tsdproxy.name: "portainer"
tsdproxy.container_port: "9000"
tsdproxy.autodetect: "false"
tsdproxy.ephemeral: "false"
tsdproxy.dash.label: "Portainer"

In what state are those proxies in dashboard?

[Lapras]

They appear fine in the dashboard. The dashboard says they are running. I can reach the services through localhost:port but not through the actual proxy IP. I get diuffernet kinds of tsdproxy errors like
tsdproxy | 2025/01/18 18:07:18 httputil: ReverseProxy read error during body copy: read tcp 172.18.0.6:39938->172.18.0.4:9443: read: connection reset by peer

[stevetrease]

Can I suggest that you post your docker-compose files for both containers and for tsdproxy?

[stevetrease]

I've been doing some digging and am seeing the same trying to access via the container's IP address rather than Tailscale MagicDNS FQDN.

https://containername.funnyname.ts.net works.
https://ipaddress fails and I see "TLS handshake error from 100.xxx.xxx.xxx:53623: no SNI ServerName" in the TSDproxy logs.

TSDproxy obtains a lets encrypt TLS certificate for the container using Tailscale's methods.
This certificate contains the container's FQDN (containername.funnyname.ts.net) but not it's Tailscale IP address.
Thus when connecting by IP address with https there is no certificate for the connection and the connection fails.
When connecting by FQDN there is a certificate and it works.

If you want to access the services via https you will need to use the FQDN using either Tailscale's magicDNS or your own dns to resolve the FQDN to the container's Tailscale IP address.

@almeidapaulopt Please correct me if I'm wrong.