Chapter 10 — Fortress I: Reach It From Anywhere Without Opening a Port (Tailscale)

9 blocks to copy, in the order they appear in the chapter. Nothing here is required to be typed by hand.

Step 1 — Install Tailscale on the host

10.1 · bash

curl -fsSL https://tailscale.com/install.sh | sh

10.2 · bash

tailscale up

10.3 · bash

tailscale status

10.4 · bash

sudo tailscale set --advertise-routes=192.168.1.0/24 --accept-dns=false

10.5 · bash

echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

10.6 · bash

sudo tailscale set --advertise-exit-node

10.7 · bash

tailscale serve https / http://127.0.0.1:8000       # Vaultwarden
tailscale serve https /immich http://127.0.0.1:2283 # Immich (if running)

10.8 · yaml

environment:
  DOMAIN: "https://drawer-pi.pango-lin.ts.net"  # no more vault.local

10.9 · bash

tailscale funnel https / http://127.0.0.1:8000