Would it work with self-hosted Headscale?

[europacafe]

Thanks for creating this useful proxy.

I really want to try it. I'm not using Tailscale website for controlling tailscale nodes, instead, I use self-hosted Headscale.

If I'm not wrong, it seems your proxy has nothing to do with Tailscale admin, so it should be working for my setup?

[almeidapaulopt]

I've made a commit that should do it, but I don't have time to set a test environment. So in next version please try it.

[europacafe]

10:46AM INF [v1] using fake (no-op) tun device
10:46AM INF [v1] using fake (no-op) tun device
10:46AM INF [v1] using fake (no-op) tun device
10:46AM INF [v1] using fake (no-op) tun device
10:46AM INF [v1] using fake (no-op) tun device
10:46AM INF [v1] using fake (no-op) tun device
10:46AM INF [v1] using fake (no-op) tun device
10:46AM INF [v1] using fake (no-op) tun device
10:46AM INF [v1] using fake (no-op) tun device
10:46AM INF [v1] using fake (no-op) tun device
10:46AM INF [v1] using fake (no-op) tun device
10:46AM INF [v1] using fake (no-op) tun device
10:46AM INF [v1] using fake (no-op) tun device
10:46AM INF [v1] using fake (no-op) tun device
10:46AM INF [v1] using fake (no-op) tun device
10:46AM INF [v1] using fake (no-op) tun device
10:46AM INF [v1] using fake (no-op) tun device
10:47AM INF request host=127.0.0.1:8080 method=GET status=200 url=/health/ready/
10:47AM INF request host=127.0.0.1:8080 method=GET status=200 url=/health/ready/
10:47AM INF request host=127.0.0.1:8080 method=GET status=200 url=/health/ready/
10:47AM INF request host=127.0.0.1:8080 method=GET status=200 url=/health/ready/
10:47AM INF request host=127.0.0.1:8080 method=GET status=200 url=/health/ready/
10:47AM INF request host=127.0.0.1:8080 method=GET status=200 url=/health/ready/
10:47AM INF request host=127.0.0.1:8080 method=GET status=200 url=/health/ready/
10:47AM INF request host=127.0.0.1:8080 method=GET status=200 url=/health/ready/
10:47AM INF request host=127.0.0.1:8080 method=GET status=200 url=/health/ready/
10:47AM INF request host=127.0.0.1:8080 method=GET status=200 url=/health/ready/

[europacafe]

I added label to both sonarr and radarr, and tsdproxy detected them and created both folders as seen from this screenshots

[europacafe]

I don't see any new machine creation log entries in my headscale log when I start tsdproxy container. Headscale dashboard also shows no new machine added. I created a reusable preauth key with a headscale command. So I'm pretty sure it is not the authkey issue.

[hugomiralles-manta]

This proxy seems to be great, but I am in the same situation, with a self-hosted Headscale server.
Before I start my deployment of TSDProxy, is it working with headscale ?

[traderarpit4]

Bumping this as I'm struggling to get TSDProxy to work with headscale (running v2, setup is fine, not exposing the proxy to the web). I keep getting:

INF home/runner/work/tsdproxy/tsdproxy/internal/proxyproviders/tailscale/provider.go:78 > LocalBackend state is NeedsLogin; running StartLoginInteractive... Hostname=tsd module=proxymanager tailscale=default

[mattdale77]

I can't see how to get it working without being able to enable https however it does work for http (I had to use version 2)

[mattdale77]

I got it working using the V2 beta. However it looks like the project is abandoned. What doesn't work is HTTPS as headscale has not implemented the let's encrypt integration. The solution is to have your own certification authority and install it on all your machines. I've not managed to implement this test though and I'm thinking about moving to Traefik and use something which is actively developed

…

On Tue, 28 Oct 2025, at 4:32 AM, traderarpit4 wrote: Bumping this as I'm struggling to get TSDProxy to work with headscale. —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you commented.Message ID: *DuckDuckGo* removed one tracker. More <https://duckduckgo.com/-hGyvyiXmf6u7VQd9sTh6kcEsdlr4_91PlK2SgdbvlB_iFwA6mboo-YeCZBDjWtiyLxsQiLNpAXZRYgQWIaVtDyKJHEORluW1nv_QG0EZaDOhaSlaGlZqZ7GorPPcG4ElpqkquhqCCAU4QAHdOixNo0B1vYV4D4BVlsTtP4InYuXvIjkBkTfIUu34gO0qjfO5nTqvFnEZtgS9eezPKQbX4ZqcvPlUNkhRaWmMMMNsilH9SJZtdqLaOrQ-eCe5qGCcLeyEcFFzkx8EZ5loe9xHoWK4XRozXTX4c6plkAM5Rv4JOWAvHr6TbqErwTPKR6j4fTIBX7DJOQsnTHz9w6ZQ1pZC-NBR_BsIvqUU3jDSWtb7Eq2Qa4ku2jykh_yNccH84T12xXZp9gfgsIpIsvnM5G7Y4Y63jtuHSXdb5bDmfuA1jxNc3-_77aEeWwxbUm5jJ1ctGkLCBr9EJQqnnHse3yyNXVomCGhkXGJg-X29g-vtLkKS4dN_JgOAT5qmCFu-VuAo5REM61wE> Report Spam <https://duckduckgo.com/-hGyvyiXmf6u7VQd9sTh6kcEsdlr4_91PlK2SgdbvlB_iFwA6mboo-YeCZBDjWtiyLxsQiLNpAXZRYgQWIaVtDyKJHEORluW1nv_QG0EZaDOhaSlaGlZqZ7GorPPcG4ElpqkquhqCCAU4QAHdOixNo0B1vYV4D4BVlsTtP4InYuXvIjkBkTfIUu34gO0qjfO5nTqvFnEZtgS9eezPKQbX4ZqcvPlUNkhRaWmMMMNsilH9SJZtdqLaOrQ-eCe5qGCcLeyEcFFzkx8EZ5loe9xHoWK4XRozXTX4c6plkAM5Rv4JOWAvHr6TbqErwTPKR6j4fTIBX7DJOQsnTHz9w6ZQ1pZC-NBR_BsIvqUU3jDSWtb7Eq2Qa4ku2jykh_yNccH84T12xXZp9gfgsIpIsvnM5G7Y4Y63jtuHSXdb5bDmfuA1jxNc3-_77aEeWwxbUm5jJ1ctGkLCBr9EJQqnnHse3yyNXVomCGhkXGJg-X29g-vtLkKS4dN_JgOAT5qmCFu-VuAo5REM61wE> Bumping this as I'm struggling to get TSDProxy to work with headscale. — Reply to this email directly, view it on GitHub <#2 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABNPJ57UISYZYH2TZMRQ6YL3Z3WXXAVCNFSM6AAAAABRFU4OF2VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTINZZHE4TONY>. You are receiving this because you commented.Message ID: ***@***.***>

[traderarpit4]

Do you know of any projects that do similar things and work for this? Also is there a particular reason you're planning on moving to Traefik? I know NPM also handles certificates, and gives access fairly easily without having to deal with the slightly more complicated setup that Traefik has.

[mattdale77]

I think TSD Bridge and there is a caddy plugin which does it possibly. Currently since headscale has not implemented the interaction with letsencrypt then none of them will supply HTTPS certificates transparently. The only way I have discovered of doing this at the moment is with a local certificate authority. Hopefully headscale implement this but I've seen no talk of it. It looked fairly easy to implement with Traefik although I've yet to do it personally. I haven't seen an NPM solution which will inject the service names into Magic DNS and get certificates for a private domain. If you know if something then I might be interested

…

On Tue, 28 Oct 2025, at 9:54 PM, traderarpit4 wrote: Do you know of any projects that do similar things and work for this? Also is there a particular reason you're planning on moving to Traefik? I know NPM also handles certificates, and gives access fai *DuckDuckGo* removed one tracker. More <https://duckduckgo.com/-hGyvyiXmf6u7VQd9sTh6kcEsWnb6Ha6V-IQ62a2ow8fry87cUTTAMPJMA-6_juC3LouPEIiw6tvnFE9lsoDhzawoZ9AiC3Cxvd7NfdgNoKy1GGNpKVoaVmpmsag-eixxfeVKaqpKrAVhwkBIUwN3T4gQ1GA49wmsw9Mqy2F0nIBEn3kt2Biorkk-x64n0JcVqgxLGkTmVNsUA1NbkOsqZNveq8XJvsltA3kTadxccUXQJf9yyxTxWsqcNeS8QmWpyAHxSTgKejaq4QwFNMaUbfHhkSJc3Ix6iJPoB6ivJQDi_ewM8oR6J31m1cY2JMxuPUvd5EAE0dJsnoeTxDydQZ6xDSuhLQ_EzEL4sF1Mz1VjW-hKvsmkIW7UPEvE_whX0ETx5RYc2-wLJmUUlo_gdXFTls-zl9dWCmfyl76vUNU5vPsYRb6vG4e-jE1putqDexIyuWTaDgg18jU4Qjr339WxXvQWYD0nHFMNSSGi7dG9g-veXIElx2b6TAckH1qmGFu-VuApjSJtsrgM> Report Spam <https://duckduckgo.com/-hGyvyiXmf6u7VQd9sTh6kcEsWnb6Ha6V-IQ62a2ow8fry87cUTTAMPJMA-6_juC3LouPEIiw6tvnFE9lsoDhzawoZ9AiC3Cxvd7NfdgNoKy1GGNpKVoaVmpmsag-eixxfeVKaqpKrAVhwkBIUwN3T4gQ1GA49wmsw9Mqy2F0nIBEn3kt2Biorkk-x64n0JcVqgxLGkTmVNsUA1NbkOsqZNveq8XJvsltA3kTadxccUXQJf9yyxTxWsqcNeS8QmWpyAHxSTgKejaq4QwFNMaUbfHhkSJc3Ix6iJPoB6ivJQDi_ewM8oR6J31m1cY2JMxuPUvd5EAE0dJsnoeTxDydQZ6xDSuhLQ_EzEL4sF1Mz1VjW-hKvsmkIW7UPEvE_whX0ETx5RYc2-wLJmUUlo_gdXFTls-zl9dWCmfyl76vUNU5vPsYRb6vG4e-jE1putqDexIyuWTaDgg18jU4Qjr339WxXvQWYD0nHFMNSSGi7dG9g-veXIElx2b6TAckH1qmGFu-VuApjSJtsrgM> Do you know of any projects that do similar things and work for this? Also is there a particular reason you're planning on moving to Traefik? I know NPM also handles certificates, and gives access fairly easily without having to deal with the slightly more complicated setup that Traefik has. — Reply to this email directly, view it on GitHub <#2 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABNPJ57PFVVAALGCTILRZX33Z7QXZAVCNFSM6AAAAABRFU4OF2VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIOBQHA2DKOI>. You are receiving this because you commented.Message ID: ***@***.***>