How does this work? :)

[wsw70]

I have an extensive set of docker services behind an edge router (Traefik, but it was also Caddy in the past) and recently started to use Tailscale in addition to my own mesh Wireguard network (Tailscale does it better, faster, simpler and nicer so if it works my own contraption will at best be a backup)

My web services are defined, DNS-wise, as a wildcard *.example.com that points to the public IP, forwarded to Traefik. This is the lazy approach that allows me to minimize the number of operations to start a service but scales to exactly one server.

So far so good.

I now discovered TSDproxy and tried to understand how it works. What I am missing is where the sonarr.XXX-XXX.ts.net names are defined. They must be "CNAMEs" to the main, Tailscale provided, name of the docker server but it is not possible I belive.

What am I missing?

[DarrenYOW]

I have exactly the same configuration (except I refer to it as "expedient" rather than "lazy" ;-). If you have Magic DNS enabled on Tailscale, it will take care of the FQDN for the Docker containers on your tailnet. You can specify the "CNAME" (e.g. sonarr) as a parameter to TSDproxy, or you can let it default to the Docker container name.

The issue you reference is related to creating custom DNS names within your tailnet that resolve to specific servers, like "sonarr.test.xxxx-xxxx.ts.net" or "sonarr.dev.xxxx-xxx.ts.net. (unless I misunderstood your question)

[wsw70]

Thank a lot @DarrenYOW for the quick reply! You are right expedient sounds much better

If you have Magic DNS enabled on Tailscale

You mean this: https://tailscale.com/kb/1282/docker ?
I had a quick look but it looks like you need to sideload an extra docker container that will handle the tailscale part - for each service. Beside that, I am not sure how this would co-live with an edge router (but it may very well, I just had a first review)

[wsw70]

The issue you reference is related to creating custom DNS names within your tailnet that resolve to specific servers, like "sonarr.test.xxxx-xxxx.ts.net" or "sonarr.dev.xxxx-xxx.ts.net. (unless I misunderstood your question)

Ah ok, you are right, it is me who misunderstood (or actually - did not read carefully enough) the Issue I referenced. Thanks.

[DarrenYOW]

You mean this: https://tailscale.com/kb/1282/docker ?

No, I mean that you have enabled Tailscale "Magic DNS" on the Tailscale DNS setting at https://login.tailscale.com/admin/dns

Beside that, I am not sure how this would co-live with an edge router

It works perfectly fine - I am using Traefik as my proxy/edge router. I have two sets of labels on each of my service containers: one for Traefik, and another for TSDproxy. The Traefik labels set up access by the FQDN at "MyDomain.com" (using local DNS with CNAMES in pi-hole), and the TSDproxy labels set up access to the associated "machines" on my Tailnet at service.xxxx-xxxx.ts.net. Two routes to get to the same service. ;-)

In Tailscale, I use tags and ACL to both identify and control access to the services. And TSDproxy replaces the Tailscale "sidecars" that I used to use to achieve the same result. (or in some cases, the Tailscale Docker Mod for linuxserver.io containers)

It's easier than you think!

[wsw70]

Thanks, I will blindly try then :) I do use MagicDNS.

What I really do not understand is how sonarr.xxxx-xxxx.ts.net, when typed in a browser, will be resolved to the docker host (which had a MagicDNS name assigned at birth, but this name is obviously not the name of the many services that live on it)

[DarrenYOW]

When TSDproxy adds the Docker container to your tailnet, Tailscale treats it as a "machine". Tailscale assigns it an IP address, and MagicDNS assigns it a FQDN on your tailnet (the "Magic" part). So, sonarr.xxxx-xxxx.ts.net is "assigned at birth" to the service , just like it was for the Docker host. Tailscale doesn't care where or what it is - everyone gets a name. So one Docker host can have many services running on it, where both the host and all of the services each have FQDNs on your tailnet. Magic!

[wsw70]

When TSDproxy adds the Docker container to your tailnet,

All right! now I understand. I did not know that it was possible to add machines to Tailnet that easily (but I did not read the doc either).