Access Tailscale Services via Funnel

[cdekort]

Currently, Tailscale Funnel is limited to 3 ports (443, 8443, 10000) which limits public exposure to only 3
services per machine. However, many Docker orchestration platforms like Dokploy come with reverse proxies (Traefik,
Nginx Proxy Manager, etc.) already configured.

Proposed Solution

Add support for a "reverse proxy mode" where DockTail can:

1. Detect an existing reverse proxy container (Traefik, Nginx, etc.)
2. Configure a single funnel pointing to the reverse proxy
3. Configure the reverse proxy to route to multiple services using:
   - Path-based routing: https://host.ts.net/service1, https://host.ts.net/service2
   - Host header routing: https://service1.host.ts.net, https://service2.host.ts.net

e.g. tailwhale.sh seems to do this, however docktail seems to cater better to the usecase in general.

Benefits

• Bypass 3-port limitation: Expose unlimited services publicly through a single funnel port
• Leverage existing infrastructure: Use the reverse proxy already configured in platforms like Dokploy
• Better resource utilization: One funnel port handles multiple services
• Standard web patterns: Path-based or subdomain routing is familiar to most users

Use Case

In Dokploy environments, Traefik is already configured and manages routing for all containers. Instead of:

• Service 1 → Funnel port 443
• Service 2 → Funnel port 8443
• Service 3 → Funnel port 10000
• Service 4+ → ❌ Can't expose publicly

We could have:

• Traefik → Funnel port 443
  • /service1 → Service 1
  • /service2 → Service 2
  • /service3 → Service 3
  • /service4 → Service 4

Proposed Implementation

New label options:
services:
myapp:
labels:
- "docktail.service.enable=true"
- "docktail.service.name=myapp"
- "docktail.funnel.proxy-mode=true" # NEW: Enable reverse proxy mode
- "docktail.funnel.proxy-path=/myapp" # NEW: Path for routing
# OR
- "docktail.funnel.proxy-subdomain=myapp" # NEW: Subdomain for routing

DockTail would then:

1. Configure the reverse proxy (via Docker labels or API) to route the specified path/subdomain to the service
2. Use a single funnel pointing to the reverse proxy

Alternative Approach

If automatic reverse proxy configuration is too complex, provide documentation/examples for manual configuration
with Traefik, Nginx Proxy Manager, and Caddy.

Environment

• Platform: Dokploy (with Traefik)
• DockTail version: latest
• Tailscale version: 1.52+

Related

This addresses the common question: "How do I expose more than 3 services publicly?"

[marvinvr]

Hey there, thanks for the suggestion! I agree that this is an unfortunate limitation at the moment, and I will definitely address this in the future. I think I'll be taking a different approach, though, since what you are suggesting would introduce a single point of failure in the mix with that new reverse proxy. There are other services like tsbridge that (more or less) take that approach with a reverse proxy.
I believe the right approach for DockTail would be to allow Services to be accessed via Funnel, which would have to be supported by Tailscale, though. That would allow it to stay decentralized with as little configuration as possible. I'll be in contact with Tailscale about this and try to make it happen. 😄
I'll go ahead and rename the ticket and keep you updated here.

[marvinvr]

https://discord.com/channels/1379528469859532931/1388174241609814137/1445140579280228404

Here's the response from a Tailscale team member. I will implement this as soon as the feature comes out 😄
Feel free to hit me up in case you notice it came out and I miss it.