Secure, zero-config ingress using Tailscale and Caddy.

Tailgate allows you to expose containerized services privately over your Tailnet with automatic HTTPS. It bundles Tailscale, Caddy, and popular plugins into a single, easy-to-deploy container.

• Private Ingress: Expose services securely via Tailscale without opening public ports.
• Automatic HTTPS: Caddy manages certificates automatically.
• Plugin Support: Includes Cloudflare DNS support out-of-the-box.
• Sablier Integration: Optional support for Sablier to scale containers on demand (Scale-to-Zero).

The recommended way to run Tailgate is via Docker Compose.

services:
  tailgate:
    image: valentemath/tailgate:latest
    container_name: tailgate
    environment:
      - TAILSCALE_AUTHKEY=tskey-auth-kB...  # Required
      - TAILSCALE_HOSTNAME=tailgate         # Optional
      - CLOUDFLARE_API_TOKEN=...            # Optional (if using DNS challenges)
    volumes:
      - tailscale-state:/tailscale          # Persist Tailscale identity
      - ./Caddyfile:/etc/caddy/Caddyfile    # Mount your config
      - caddy-data:/data                    # Persist Caddy certificates

volumes:
  tailscale-state:
  caddy-data:

Create a Caddyfile in the same directory. Tailgate will serve this configuration over your Tailnet.

# Example: Reverse proxy a service on your Tailnet
machine-name.tailnet-name.ts.net {
    reverse_proxy other-container:80
}

docker compose up -d

Only applicable when using the latest-with-sablier image.

Note on Sablier:
When using the -with-sablier image, the Sablier binary is downloaded at runtime if INCLUDE_SABLIER is set to true. You must mount a configuration file to /etc/sablier/sablier.yml and provide access to the Docker socket.

services:
  tailgate:
    image: valentemath/tailgate:latest-with-sablier
    volumes:
      - ./sablier.yml:/etc/sablier/sablier.yml
      - /var/run/docker.sock:/var/run/docker.sock:ro

If you need Caddy plugins other than Cloudflare or Sablier, you can build your own image using the provided Dockerfile.

1. Clone the repository.
2. Modify docker-compose.yaml:
   Update the PLUGINS build argument to include the Go import paths of the plugins you need.

   build:
     context: .
     args:
       PLUGINS: "github.com/caddy-dns/duckdns github.com/caddy-dns/route53"

3. Build and Run:

   docker compose up -d --build

• Tailscale
• Caddy
• Sablier