name: tailscale

x-daemonless:
  title: "Tailscale"
  icon: ":simple-tailscale:"
  category: "Infrastructure"
  description: "Zero-config mesh VPN built on WireGuard — securely connect your devices without port forwarding or firewall changes."
  upstream_url: "https://github.com/tailscale/tailscale"
  web_url: "https://tailscale.com/"
  freshports_url: "https://www.freshports.org/security/tailscale/"
  user: "root"
  mlock: false
  upstream_binary: false
  appjail: true

  docs:
    env:
      TS_AUTHKEY:
        desc: "Tailscale Auth Key for automatic login — create one at https://login.tailscale.com/admin/settings/keys"
        optional: true
        level: primary
      TS_EXTRA_ARGS:
        desc: "Additional arguments for tailscale up"
        optional: true
    volumes:
      /config: "State directory (tailscaled.state)"

services:
  tailscale:
    image: ghcr.io/daemonless/tailscale:latest
    container_name: tailscale
    restart: unless-stopped

    environment:
      - TS_AUTHKEY=tskey-auth-xxxx
      - TS_EXTRA_ARGS=--advertise-exit-node

    volumes:
      - /path/to/containers/tailscale:/config