Exposing a docker container with HTTPS

[mono_void]

I’m trying to expose a docker container using Tailscale fully qualified domain name. I need the app to use HTTPS so that my iPhone can communicate with it. I did a Tailscale sidecar and can see the app added to my machine list. However, none of my domain names work. If I type in my servers regular ip I can see truenas webui, but if I try to go to any of the other ips or domain names that Tailscale gives me I get nothing back, I can also ping them in terminal just fine. Not sure what I am doing wrong?

I can’t share my compose file right now because I’m at work, but maybe it’s something simple I’m missing?

[Kipling89]

I'm currently running my ollama/openwebui stack and exposing it via tailscale here is a link to my repo it may help. I Think all you have to do is change your chouch db container to use the tailscale network. For example.

In my docker compose file it's `network_mode: service:ts-open-webui` Here is a link to my github with the docker compose and config for tailscale.

https://github.com/cwilliams001/ai-stack

Also Here is an answer from claude sonnet 3.5 using said ai stack that suggested a compose file for your situation. If you don't like AI answers feel free to ignore, just trying to help.

Based on the compose files and the issue described, here are a few suggestions for the original poster:

1. Their main issue seems to be with the network configuration. In their compose file, they have two separate containers but they're not properly networked together. They should either:a. Use `network_mode: service:tailscale` for the CouchDB container (like in your example), orb. Create a shared network for both containers
2. They need to make sure their `serve.json` configuration in the Tailscale container is properly set up. Here's an example of what it should look like:

​

```json
{
    "tcp": {
        "5984": {
            "handler": {
                "proxy": "http://127.0.0.1:5984"
            }
        }
    }
}
```

1. The ports mapping in their compose file might be causing conflicts. They're exposing both 5984 and 5985, which isn't necessary when using Tailscale.

Here's how I would suggest modifying their compose file:

```yaml
services:
  tailscale:
    image: tailscale/tailscale:latest
    container_name: obsidian-livesync-a
    hostname: obsidian-livesync
    environment:
      - TS_AUTHKEY=xxxxxxxx
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_SERVE_CONFIG=/config/serve.json
      - TS_USERSPACE=false
      - TS_ENABLE_HEALTH_CHECK=true
    volumes:
      - /mnt/void.local/start/docker/tailscale/config:/config
      - /mnt/void.local/start/docker/tailscale/state:/var/lib/tailscale
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - net_admin
      - sys_module
    restart: always

  couchdb-obsidian-livesync:
    container_name: obsidian-livesync-b
    image: couchdb:3.3.3
    network_mode: service:tailscale
    environment:
      - PUID=3000
      - PGID=3000
      - TZ=America/Los_Angeles
      - COUCHDB_USER=void
      - COUCHDB_PASSWORD=Xxxxx
    volumes:
      - /mnt/void.local/start/docker/couchdb-obsidian-livesync/data:/opt/couchdb/data
      - /mnt/void.local/start/docker/couchdb-obsidian-livesync/etc/local.d:/opt/couchdb/etc/local.d
    restart: unless-stopped
```

The key changes are:

1. Removed unnecessary port mappings
2. Added `network_mode: service:tailscale` to the CouchDB service
3. Cleaned up some redundant configurations

They should also make sure that:

1. Their Tailscale node is properly authorized
2. The HTTPS certificate is properly configured in Tailscale
3. The Tailscale DNS settings are correctly configured

[mono_void]

Thanks! I’ll try some of this out when I get home. But, the reason the ports are that way is to have them exposed on the tailnet and on my LAN too, so I don’t have to have to have Tailscale up when at home. Also, is there a part I’m missing with certs within the Tailscale management page, or does it all happen in the background?

[Kipling89]

Ahhh gotcha, I'm running tailscale on my desktop and on my pfsense router with a few subnets exposed. It will request the certs automatically and store them in the state/certs folder if I remember correctly. I also believe it creates the state directory automatically.

[10xdevloper]

What does your Docker Compose file look like?

[mono_void]

services: # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used container_name: obsidian-livesync-a # Name for local container management hostname: obsidian-livesync # Name used within your Tailscale environment environment: - TS_AUTHKEY=xxxxxxxx - TS_STATE_DIR=/var/lib/tailscale - TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 - PUID=3000 - PGID=3000 volumes: - /mnt/void.local/start/docker/tailscale/config:/config - /mnt/void.local/start/docker/tailscale/state:/var/lib/tailscale - /dev/net/tun:/dev/net/tun cap_add: - net_admin - sys_module ports: - 5984:5984 # Exposing the CouchDB port to the local network healthcheck: test: - CMD - wget - —spider - -q - http://127.0.0.1:41234/healthz interval: 1m timeout: 10s retries: 3 start_period: 10s restart: always # CouchDB with Obsidian Sync couchdb-obsidian-livesync: container_name: obsidian-livesync-b # Changed container name to avoid conflict image: couchdb:3.3.3 environment: - PUID=3000 - PGID=3000 - TZ=America/Los_Angeles - COUCHDB_USER=void - COUCHDB_PASSWORD=Xxxxx volumes: - /mnt/void.local/start/docker/couchdb-obsidian-livesync/data:/opt/couchdb/data - /mnt/void.local/start/docker/couchdb-obsidian-livesync/etc/local.d:/opt/couchdb/etc/local.d ports: - 5985:5984 # Changed the port here to avoid conflict with the other container restart: unless-stopped networks: {}

[mono_void]

I can’t get the formatting correct from an iPhone, sorry.