Help me get the basics to work

[kommandantredundant]

I am pretty new to networking and I cannot wrap my head around, how exactly tsdproxy works and where I should even start to troubleshoot my problem.

I am trying to set up some (I hope) rather simple services using tailscale and tsdproxy. I started with homeassistant and stirlingPDF, as they have rather simple compose files with not so many variables. I have fiddled through all possibilities I could think of, but I cannot make them available as a ts machine, that is reachable on its ts name.

I use docker compose to setup my containers. Tailscale is installed on both my rpi and my laptop, In the admin console of tailscale, I can see them both as machines. tsdproxy is running on my rpi and is reachable under rpi.funny-name.ts. net:8080 as per default configuration.

Now I want to set up HA. I insert into the default HA compose file:

labels:
tsdproxy.enable: “true”
tsdproxy.name: “homeassistant”`

This is already enough to make HA appear as a tailscale machine.
Although I cannot reach HA under homeassistant.funny-name.ts. net. I tried both with and without https and :8123

I can reach it under rpi.funny-name.ts. net:8123 though as I have network_mode: "host" in the default config. If I take that out, I can’t reach HA at all. I already tried

• using tsdproxy.container_port: "8123" as a label,
• deliberately exposing ports: - 8123:8123 ,
• putting both tsdproxy and homeassistant on the same docker network

in literally every combination possible. I am pretty sure I am somewhere messing up the networking so that tsd, tailscale and HA are just not able to communicate with each other, but I do not understand enough of this part of docker & tailscale. I get the exact same problem when trying to set up stirlingPDF. I can see the machine, but I cannot access it.

When I click on the links on the tsdproxy dashboard, I get a HTTP ERROR 502 after a long wait.

What do I need to change in my HA/stirlingpdf compose file, to make this work?

Every bit of help is much apprechiated!
Thanks!

--
Laptop is running Win11
Rpi 5 is running Raspbian OS

[stevetrease]

Could you check your Home Assistant logs? Are you seeing messages like this when you try to connect?

ERROR (MainThread) [homeassistant.components.http.forwarded] Received X-Forwarded-For header from an untrusted proxy 172.25.0.1

If so, you need to tell Home Assistant to accept messages from TSDProxy with a statement along the lines of this in your Home Assistant's configuration.yaml:

http:
  ip_ban_enabled: false
  server_port: 8123
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.25.0.0/16

There is more information in the HA documentation here.

Note that exact IP address that docker chooses for it's "internal" address might be different each time you create the container.

If that doesn't work, please post your full HA docker compose file.

[kommandantredundant]

the docker logs are:

pi@rpi:~ $ docker logs homeassistant -f
s6-rc: info: service s6rc-oneshot-runner: starting
s6-rc: info: service s6rc-oneshot-runner successfully started
s6-rc: info: service fix-attrs: starting
s6-rc: info: service fix-attrs successfully started
s6-rc: info: service legacy-cont-init: starting
s6-rc: info: service legacy-cont-init successfully started
s6-rc: info: service legacy-services: starting
services-up: info: copying legacy longrun home-assistant (no readiness notification)
s6-rc: info: service legacy-services successfully started

the .log files in my homeassistant config directory are all empty? i tried logging in with false credentials, which gets logged, but otherwise there is nothing in them

[stevetrease]

For the record, this is my Home Assistant docker-compose file:

services:
  homeassistant:
    image: homeassistant/home-assistant:latest
    ports:
      - 8123:8123
    restart: always
    volumes:
      - ./config:/config
      - /var/run/dbus:/run/dbus:ro
    labels:
      tsdproxy.enable: "true"
      tsdproxy.name: "HA"
      tsdproxy.dash.label: "Home Assistant Test"
      tsdproxy.container_port: 8123
      tsdproxy.funnel: "false"

~

[kommandantredundant]

This is what I am using:

services:
  homeassistant:
    image: homeassistant/home-assistant:latest
    container_name: homeassistant
    volumes:
      - ./config:/config
      - /etc/localtime:/etc/localtime:ro
      - /var/run/dbus:/run/dbus:ro
    labels:
      tsdproxy.enable: "true"
      tsdproxy.name: "ha"
      tsdproxy.dash.label: "Home Assistant"
      tsdproxy.container_port: 8123
      tsdproxy.funnel: "false"
    ports:
      - 8123:8123
    privileged: true # needed for some integrations
    environment:
      - TZ=Europe/Berlin # Replace with your timezone (e.g., Europe/Berlin)
    restart: unless-stopped

I have machted most parts with your config, but I still get the same results
only differences I see are env variables and the privileged parameter (which the comment says is needed, but you don't use?

[stevetrease]

Can you see the "machine" created by TSDProxy for Home Assistant in the Tailscale console? Is it showing as online (green dot)?

Maybe also post your TSDProxy docker-compose file and config.... (take care to redact any auth-keys).

Steve

[kommandantredundant]

I can see the machine, it's online and getting the ephemeral flag and tags I gave them via auth key.

This is my tsdproxy compose:

services:
  tsdproxy:
    image: almeidapaulopt/tsdproxy:latest
    container_name: tsd
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - tsdproxydata:/data
    environment:
      - TSDPROXY_AUTHKEY=tskey-auth-
      - DOCKER_HOST=unix:///var/run/docker.sock
    ports:
      - 8080:8080
    restart: unless-stopped

volumes:
  tsdproxydata:

This is my tsdproxy.yaml config:

defaultProxyProvider: default
docker:
    local:
        host: unix:///var/run/docker.sock
        defaultProxyProvider: default
files:
    critical:
        filename: /config/critical.yaml
        defaultProxyAccessLog: true
tailscale:
    providers:
        default:
            authKey: tskey-auth-
            #controlUrl: https://controlplane.tailscale.com
    dataDir: /data/
http:
    hostname: 0.0.0.0
    port: 8080
log:
    level: error
    json: false
proxyAccessLog: true

That sets up tsdproxy on rpi:8080 and I can see the port on the tailscale machine port list of my rpi. Dashboard is working as well. I cannot see tsdproxy as a seperate tailscale machine (as expected?).

I already tried adding - TSDPROXY_HOSTNAME= with the ts hostname of my rpi, both here and later in the config file (targetHostname:), but that didn't do any good either.

[kommandantredundant]

yeah dumb me, guess i gotta revoke that key 💀 but thanks for the warning anyways!

[kommandantredundant]

So today I tackled the problem again. I started fully from scratch, using tsdproxy v2 and see if that helps - no changes here though. All I realized is, that the "/config/tsdproxy.yaml is created and populated with the following" is actually not what is being autopopulated.

I have the feeling that I'm overlooking something that everyone else takes for granted, so it isn't even in the documentation...
I triple-checked all my tailscale settings:

• MagicDNS is ON
• https is ON

I tried different browsers on different machines in my tailscale network.
I even tried with the nginx example - doesn't work either. It is getting a machine on my tsnet, I see it on the tsd dashboard, but I cannot access it at all (still getting 502 error).

I feel like I am missing out on a crucial part of docker networks or the tls certificate generation, that should be done automatically in the background?

I am running the default docker configs, do I have to change targetHostname: 172.31.0.1 to the tailscale IP address of my raspberry pi or do I leave it like that?

@almeidapaulopt do you have any idea here?