docker-compose.tailscale.yml

# Optional Tailscale overlay.
#
# Puts Caddy behind a Tailscale sidecar so the app is only reachable from
# devices on your tailnet. The sidecar (`ts-edge`) joins your tailnet and
# Caddy shares its network namespace, so Caddy listens only on the tailnet
# IP. No host ports are published. ACME uses the Cloudflare DNS-01 challenge
# (port 80 is not reachable from the public internet).
#
# Usage:
#   docker compose -f docker-compose.yml -f docker-compose.tailscale.yml up -d
#
# Required env: TS_AUTHKEY, DOMAIN, CF_API_TOKEN, ACME_EMAIL.
# See docs/deployment/tailscale.md for the full setup.
#
# Requires Docker Compose v2.24+ for the `!reset` directive.

services:
  ts-edge:
    image: tailscale/tailscale:stable
    environment:
      TS_AUTHKEY: ${TS_AUTHKEY}
      TS_HOSTNAME: ${TS_HOSTNAME:-brain}
      TS_EXTRA_ARGS: "--ssh=false"
      TS_STATE_DIR: /var/lib/tailscale
      TS_USERSPACE: "false"
    volumes:
      - ts-state:/var/lib/tailscale
    devices:
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - NET_ADMIN
      - NET_RAW
    sysctls:
      net.ipv4.ip_forward: "1"
      net.ipv6.conf.all.forwarding: "1"
    networks:
      - internal
    healthcheck:
      test: [ "CMD", "tailscale", "status" ]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 60s
    restart: unless-stopped

  caddy:
    ports: !reset []
    networks: !reset []
    network_mode: "service:ts-edge"
    depends_on:
      ts-edge:
        condition: service_healthy
      web:
        condition: service_healthy
    volumes:
      - ./ops/caddy/Caddyfile.tailscale:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
      - caddy-config:/config

volumes:
  ts-state: