ScaleTail provides ready-to-run Docker Compose stacks that connect self-hosted applications to your Tailnet. Each stack runs a Tailscale sidecar container, so the application joins your Tailnet as its own device. Most stacks publish the application at an HTTPS address such as https://vaultwarden.<tailnet>.ts.net, reachable from your Tailnet only.
Alex from the official Tailscale YouTube channel did a deep dive into ScaleTail! He walks through how to deploy a secure, private service of ScaleTail in under 10 minutes.
You need:
- A Linux host with Docker Engine, Docker Compose 2.23.1 or later, and Git. Check the Compose version with
docker compose version. - MagicDNS and HTTPS certificates enabled for your Tailnet, on the DNS page of the admin console. Without them, the
https://address of a stack does not work. With HTTPS enabled, device names appear in public certificate transparency logs.
-
Create an auth key on the Keys page of the admin console.
- Leave Ephemeral off. Tailscale removes an ephemeral device 30 to 60 minutes after it goes offline, for example when you stop the stack.
- Turn on Pre-approved if your Tailnet uses device approval.
- Turn on Reusable to use the key for more than one stack.
-
Get the stacks and choose a service.
git clone https://github.com/tailscale-dev/ScaleTail.git cd ScaleTail/services/<service>
Replace
<service>with the directory from the Details link in Available configurations, for exampleuptime-kuma. -
Read the service README. "Before you start" lists what the service needs beyond these steps, such as secrets to generate. Until you set them, Compose stops with an error such as
required variable DB_PASSWORD is missing a value. -
Edit
.env. Open the hidden file.env, for example withnano .env. Paste your auth key afterTS_AUTHKEY=and set the values that the service README asks for. -
Start the stack.
docker compose up -d docker compose ps
The application starts after the
tailscalecontainer reportshealthy. If a container is not running, read the logs withdocker compose logs. -
Open the service. From a device in your Tailnet, open the web interface from "At a glance" in the service README, usually
https://<SERVICE>.<tailnet>.ts.net.<SERVICE>is the value ofSERVICEin.env, and<tailnet>.ts.netis your Tailnet DNS name, for exampletail1234.ts.net. The first request can take up to a minute, because Tailscale requests the certificate at that moment. Then follow "First run" in the service README. Some stacks have no web interface, and their service README says how to reach them. -
Keep the device connected. Its node key expires after 180 days by default. To prevent that, disable key expiry for the device on the Machines page.
Every stack starts from the same standard setup, which explains the containers, the Tailnet address, the data folders, and the settings in .env.
- Featured by Tailscale
- Quick Start
- Available configurations
- Update a stack
- Remove a stack
- Get help
- Tailscale Serve and Funnel
- Documentation
- Contributors
- Contributing
- Star history
- License
| 🌐 Service | 📝 Description | 🔗 Link |
|---|---|---|
| 🛡️ AdGuard Home | A network-wide DNS server that blocks ads and trackers. | Details |
| 🔄 AdGuardHome Sync | A tool for syncing configuration across multiple AdGuard Home instances. | Details |
| 🌐 Caddy | A web server and reverse proxy with automatic HTTPS. | Details |
| 🌐 DDNS Updater | A self-hosted solution to keep DNS A/AAAA records updated automatically. | Details |
| 🌐 FlareSolverr | A proxy server to bypass Cloudflare and DDoS-GUARD protection. | Details |
| 🔍 Nessus | A vulnerability scanner from Tenable, with a limited free license called Nessus Essentials. | Details |
| 🗃️ NetBox | A source of truth for documenting IP addresses, racks, devices, connections, and circuits. | Details |
| 🧩 Pi-hole | A network-level ad blocker that acts as a DNS sinkhole. | Details |
| 🆔 Pocket ID | A self-hosted OIDC provider that signs users in to your services with passkeys. | Details |
| 🌐 RustDesk Server | A self-hosted ID and relay server for RustDesk remote desktop clients. | Details |
| 🌐 Tailscale App Connector Node | Configure a device to act as an app connector for your Tailscale network. | Details |
| 🚀 Tailscale Exit Node | Configure a device to act as an exit node for your Tailscale network. | Details |
| 🌐 Tailscale Subnet Router Node | Configure a device to act as a subnet router node for your Tailscale network. | Details |
| 🔒 Technitium DNS | An open-source DNS server with ad blocking, forwarders, and your own DNS zones. | Details |
| 🌐 Traefik | A reverse proxy and load balancer that routes requests to Docker containers by label. | Details |
| 🎥 Service | 📝 Description | 🔗 Link |
|---|---|---|
| 🎵 ArtistTrackarr | A self-hosted dashboard for tracking upcoming and newly released albums and EPs. | Details |
| 🎧 Audiobookshelf | A self-hosted audiobook and podcast server with multi-user support and playback syncing. | Details |
| 🎥 Bazarr | A companion tool to Radarr and Sonarr for managing subtitles. | Details |
| 📚 BookLore | A self-hosted application for managing and reading books. | Details |
| ⚙️ Configarr | A tool that syncs TRaSH Guides and your own YAML configuration to Radarr, Sonarr, and related services. | Details |
| 📰 FreshRSS | A customizable feed reader with themes, extensions, and no separate database. | Details |
| 🎮 Hytale | A self-hosted Hytale game server. | Details |
| 🖼️ Immich | A self-hosted Google Photos alternative with face recognition and mobile sync. | Details |
| 📺 Jellyfin | An open-source media system that puts you in control of managing and streaming your media. | Details |
| 📖 Kavita | An open-source, self-hosted digital library for comics, manga, and ebooks. | Details |
| 📺 MeTube | A self-hosted web UI for yt-dlp that downloads video and audio from YouTube and many other sites. | Details |
| ⛏️ Minecraft | A self-hosted Minecraft Java Edition server for private Tailnet multiplayer. | Details |
| 📻 Miniflux | A minimalist and opinionated feed reader. | Details |
| 🎶 Navidrome | A self-hosted music server that streams your collection to its web player and Subsonic-compatible apps. | Details |
| 🎵 Picard | A music tagger that looks up your files in MusicBrainz and writes tags and cover art, used through your browser. | Details |
| 🎬 Plex | A media server that organizes video, music, and photos from personal media libraries. | Details |
| 🖼️ Posterizarr | A tool that creates matching posters, backgrounds, and title cards for Plex, Jellyfin, and Emby libraries. | Details |
| 📡 Prowlarr | An indexer manager and proxy for applications like Radarr, Sonarr, and Lidarr. | Details |
| 📥 qBittorrent | An open-source BitTorrent client. | Details |
| 🎞️ Radarr | A movie collection manager for Usenet and BitTorrent users. | Details |
| ♻️ Recyclarr | A tool that syncs TRaSH Guides quality profiles and custom formats to Radarr and Sonarr. | Details |
| 🎬 Seerr | A request management and media discovery tool for Plex, Jellyfin, and Emby. | Details |
| 🔗 Slink | A self-hosted image hosting and sharing platform with shareable links. | Details |
| 📡 Sonarr | A PVR for Usenet and BitTorrent users to manage TV series. | Details |
| 🎶 Swing Music | A self-hosted music player and streaming server for your local audio library. | Details |
| 📊 Tautulli | A monitoring and tracking tool for Plex Media Server. | Details |
| 💼 Service | 📝 Description | 🔗 Link |
|---|---|---|
| 💰 Actual Budget | A self-hosted personal finance and budgeting app focused on privacy and full data ownership. | Details |
| 🧠 AFFiNE | A self-hosted workspace for documents, whiteboards, and databases. | Details |
| ⚓ Anchor | An offline-first, self-hosted note-taking app with sync, attachments, sharing, and optional OIDC authentication. | Details |
| 📄 BentoPDF | A privacy-first PDF toolkit that merges, splits, compresses, converts, and edits PDFs in the browser. | Details |
| ✂️ ClipCascade | A self-hosted server that syncs your clipboard across devices with end-to-end encryption. | Details |
| 🗂️ Copyparty | A self-hosted file server with accelerated resumable uploads. | Details |
| 📚 Docmost | A self-hosted, real-time collaborative wiki with rich editing, diagrams, permissions, and full-text search. | Details |
| ✅ Donetick | A self-hosted task and chore manager for households and small groups. | Details |
| ✅ DumbDo | A self-hosted, minimalistic task manager for simple to-do lists. | Details |
| ✅ Eigenfocus | A self-hosted project and task manager with boards and time tracking. | Details |
| 🗂️ EspoCRM | A self-hosted CRM for sales, support, and marketing. | Details |
| 📝 Excalidraw | A virtual whiteboard for sketching hand-drawn style diagrams. | Details |
| 📝 flatnotes | A simple, self-hosted note-taking app using Markdown files. | Details |
| 👨🏼💻 Forgejo | A community-driven, self-hosted Git service. | Details |
| 📋 Formbricks | A self-hosted, open-source platform for collecting user feedback, surveys, and NPS. | Details |
| ✍️ Ghost | An open-source publishing platform for blogs and newsletters. | Details |
| 👨🏼💻 Gitea | A lightweight, self-hosted Git service with repository hosting, pull requests, and issue tracking. | Details |
| 🧑🧑🧒🧒 Gramps Web | A web-based genealogy platform for browsing and editing family trees together. | Details |
| 🔖 Haptic | A local-first, open-source Markdown note editor. | Details |
| 🌿 Isley | A self-hosted cannabis grow journal for tracking plants and managing grow data. | Details |
| 🗂️ Kaneo | A self-hosted project management tool with boards and tasks, focused on simplicity. | Details |
| 🗒️ Karakeep | A self-hosted bookmark manager that archives links, notes, and images, with full-text search and optional AI tagging. | Details |
| 🧠 LanguageTool | An open-source grammar, style, and spell checker server for many languages. | Details |
| 🔖 linkding | A self-hosted bookmark manager to save and organize links. | Details |
| 📥 Mattermost | A self-hosted collaborative workflow and communication tool. | Details |
| 📝 Memos | A lightweight, self-hosted Markdown note-taking app for quick notes on a timeline. | Details |
| 📝 Nanote | A lightweight, self-hosted note-taking app with Markdown support. | Details |
| 📂 NextExplorer | A self-hosted file explorer for managing mounted directories. | Details |
| 🤖 Open WebUI | A self-hosted AI platform with a ChatGPT-style interface for local and cloud-based models. | Details |
| 📚 Paperless-ngx | An open-source document management system that transforms physical documents into a searchable archive. | Details |
| 🔗 Pingvin Share | PROJECT ARCHIVED A self-hosted file sharing platform. | Details |
| 📅 Radicale | A lightweight CalDAV and CardDAV server for self-hosted calendar, to-do, and contact sync. | Details |
| 🔄 Resilio Sync | A peer-to-peer tool that syncs folders directly between your devices. | Details |
| 📁 Seafile | A self-hosted file syncing and collaboration platform with file sharing, versioning, and team library support. | Details |
| 🗂️ Stirling-PDF | A web application for managing and editing PDF files. | Details |
| 🏦 SubTrackr | A self-hosted web app to track subscriptions, renewal dates, costs, and payment methods. | Details |
| 💰 Sure | A self-hosted personal finance and budgeting app with optional AI insights. | Details |
| 🗃️ Vaultwarden | An unofficial Bitwarden server implementation written in Rust. | Details |
| ✅ Vikunja | A self-hosted to-do and project management app with lists, boards, and reminders. | Details |
| 💸 Wallos | A self-hosted tracker for recurring subscriptions and expenses, with multi-currency support. | Details |
| 📚 XWiki | A wiki platform for documentation and knowledge management, with structured pages and extensions. | Details |
| 📊 Service | 📝 Description | 🔗 Link |
|---|---|---|
| 🧭 Glance | A lightweight, customizable dashboard that puts your feeds, such as RSS, weather, and markets, on one page. | Details |
| 🖥️ Homarr | A customizable dashboard for your self-hosted services, with drag-and-drop configuration and app integrations. | Details |
| 🏠 Homepage | A highly customizable application dashboard with Docker and service integrations. | Details |
| 🖼️ NewWallpaperWhoDis | A self-hosted wallpaper server that rotates your collection on browsers, tablets, smart TVs, and dashboards. | Details |
| 🛠️ Service | 📝 Description | 🔗 Link |
|---|---|---|
| 🧰 Arcane | A self-hosted web UI to manage Docker containers, images, networks, volumes, and Compose projects. | Details |
| 🛠️ Coder | A self-hosted platform for development environments that you define as Terraform templates. | Details |
| 🔧 CyberChef | A web app for encryption, encoding, compression, and data analysis. | Details |
| 🐳 Dockge | A lightweight, self-hosted Docker Compose stack manager with a web UI. | Details |
| 🐳 Dockhand | A lightweight Docker management UI for containers and Compose stacks on local and remote hosts. | Details |
| 🖥️ Dozzle | A real-time log viewer for Docker containers. | Details |
| 📁 File Browser | PROJECT ARCHIVED A web file manager for one folder on your server. Upstream gives no further security fixes. | Details |
| 🔁 FossFLOW | A self-hosted tool to draw isometric infrastructure diagrams. | Details |
| 🖥️ GitSave | A self-hosted service that backs up your Git repositories from GitHub, GitLab, and others on a schedule. | Details |
| 🖥️ Gokapi | A lightweight self-hosted file sharing platform. | Details |
| 🖥️ IT-Tools | A collection of handy online tools for developers and sysadmins. | Details |
| 📧 Mailpit | A self-hosted email testing tool for capturing, viewing, and debugging outgoing emails during development. | Details |
| 🖥️ Node-RED | A flow-based development tool for visual programming. | Details |
| 🧠 Ollama | A self-hosted solution for running open large language models (LLMs) locally with an OpenAI-compatible API. | Details |
| 🖥️ Portainer | A lightweight management UI which allows you to easily manage your Docker environments. | Details |
| 🔍 SearXNG | A free internet metasearch engine which aggregates results from various search services. | Details |
| 📈 Service | 📝 Description | 🔗 Link |
|---|---|---|
| 🛰️ Beszel Agent | An agent that collects system and Docker stats and reports them to a Beszel Hub. | Details |
| 📉 Beszel Hub | A lightweight server monitoring hub with historical data, Docker stats, and alerts. | Details |
| 🖥️ changedetection.io | A tool for monitoring website changes. | Details |
| 🔎 Portracker | A self-hosted tool that discovers the services on your systems and maps the ports they use. | Details |
| 🚀 Speedtest Tracker | A self-hosted tool to monitor and log internet speed tests with detailed visualizations. | Details |
| 📊 Umami | An open-source web analytics platform that respects user privacy. | Details |
| 📊 Uptime Kuma | A self-hosted monitoring tool that checks your websites and services and alerts you when they go down. | Details |
| 🏠 Service | 📝 Description | 🔗 Link |
|---|---|---|
| 🎥 Frigate | A self-hosted NVR with real-time AI object detection for IP cameras and local video monitoring. | Details |
| 🏡 Home Assistant | An open-source home automation platform for controlling smart devices. | Details |
| 📱 Service | 📝 Description | 🔗 Link |
|---|---|---|
| 🔁 ConvertX | A self-hosted online file converter for documents, images, audio, video, and over a thousand other formats. | Details |
| 🔔 Gotify | A simple server for sending and receiving messages in real-time. | Details |
| 🔐 Hemmelig | PROJECT ARCHIVED A self-hosted, zero-knowledge encrypted secret sharing platform with expiring secrets. | Details |
| 📦 Homebox | A self-hosted home inventory and asset management system. | Details |
| 🚗 LubeLogger | A self-hosted vehicle maintenance and fuel mileage tracker. | Details |
| 📱 Mini QR | A self-hosted app to create, style, and scan QR codes. | Details |
| 📣 ntfy | A simple HTTP-based pub/sub notification service for sending push notifications. | Details |
| 🚗 Tracktor | A self-hosted app to track your vehicles' fuel use, maintenance, insurance, and documents. | Details |
| 🔁 Transmute | A self-hosted file converter and compressor for images, video, audio, and documents, with a web UI and API. | Details |
| 🍽️ Service | 📝 Description | 🔗 Link |
|---|---|---|
| 🥘 KitchenOwl | A self-hosted grocery list and recipe manager with meal planning and expense tracking for households. | Details |
| 🥘 Mealie | A self-hosted recipe manager and meal planner with features like shopping lists, scaling, and importing. | Details |
| 🥘 Tandoor Recipes | A self-hosted recipe manager and meal planner with shopping lists, nutrition tracking, and recipe import. | Details |
Most stacks use the latest image tag. To get newer images, run this from the service directory:
docker compose pull
docker compose up -dTo get the latest version of the stacks, update your clone. Git does not overwrite files that you changed, such as .env, so set your changes aside first:
git stash
git pull
git stash popIf git stash pop reports a conflict in .env, open the file, keep your values, delete the <<<<<<<, =======, and >>>>>>> lines, then run git reset and git stash drop.
Before you restart the stack, read the "Upgrading" section of the service README, if it has one.
From the service directory, run docker compose down --volumes. To remove the stack completely, also remove the device on the Machines page and delete the service directory. It contains the Tailscale state in ./ts/state and the application data. The containers create some of these folders as root, so deleting them may need sudo.
- Read the "Troubleshooting" section of the service README, and check the logs with
docker compose logs. - Ask questions in the Tailscale Discord.
- Report a problem with a stack in a GitHub issue.
Tailscale Serve routes traffic from other devices in your Tailnet to a service on one device. Tailscale Funnel routes traffic from the public internet to that service, so people without Tailscale can reach it.
Stacks that use Serve keep Funnel off ("AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false} in compose.yaml), so they are reachable from your Tailnet only. Umami has an opt-in public mode; see its README.
To make a service reachable from the internet:
- Add
funneltonodeAttrsin your Tailnet policy file for the device, as described in Tailscale Funnel. - In
compose.yaml, changefalsetotruein theAllowFunnelline. - Recreate the stack with
docker compose up -d --force-recreate.
Funnel is in beta and listens only on ports 443, 8443, and 10000. It requires MagicDNS and HTTPS certificates, as in the Quick Start. Anyone on the internet can then reach the application, so turn on its login first.
In this repository:
- The standard ScaleTail setup
- Free up port 53 on the Docker host
- Install Tailscale on an OpenPLi set-top box (without Docker)
From Tailscale:
- Tailscale documentation
- Docker and its configuration parameters
- Tailscale Serve
- Tailscale Funnel
- A deep dive into using Tailscale with Docker
A huge thank you to all our contributors! ScaleTail wouldn't be what it is today without your time, effort, and ideas!
Made with contrib.rocks.
See CONTRIBUTING.md for guidance on adding services with the template to keep Tailscale-sidecar setups consistent.