Tailscale

Provision TLS certificates for your internal Tailscale services.

To protect a service with TLS, a certificate from a public Certificate Authority is needed. In addition to its vpn role, Tailscale can also provide certificates for the machines in your Tailscale network.

Configuration Example

To obtain a TLS certificate from the Tailscale daemon, a Tailscale certificate resolver needs to be configured as below.

Enabling Tailscale certificate resolution

File (YAML)

  1. entryPoints:
  2.   web:
  3.     address: ":80"
  5.   websecure:
  6.     address: ":443"
  8. certificatesResolvers:
  9.   myresolver:
  10.     tailscale: {}

File (TOML)

  1. [entryPoints]
  2.   [entryPoints.web]
  3.     address = ":80"
  5.   [entryPoints.websecure]
  6.     address = ":443"
  8. [certificatesResolvers.myresolver.tailscale]

CLI

  1. --entrypoints.web.address=:80
  2. --entrypoints.websecure.address=:443
  3. # ...
  4. --certificatesresolvers.myresolver.tailscale=true

Domain from Router’s Rule Example

Docker & Swarm

  1. labels:
  2.   - traefik.http.routers.blog.rule=Host(`monitoring.yak-bebop.ts.net`) && Path(`/metrics`)
  3.   - traefik.http.routers.blog.tls.certresolver=myresolver

Docker (Swarm)

  1. deploy:
  2.   labels:
  3.     - traefik.http.routers.blog.rule=Host(`monitoring.yak-bebop.ts.net`) && Path(`/metrics`)
  4.     - traefik.http.routers.blog.tls.certresolver=myresolver

Kubernetes

  1. apiVersion: traefik.io/v1alpha1
  2. kind: IngressRoute
  3. metadata:
  4.   name: blogtls
  5. spec:
  6.   entryPoints:
  7.     - websecure
  8.   routes:
  9.     - match: Host(`monitoring.yak-bebop.ts.net`) && Path(`/metrics`)
  10.       kind: Rule
  11.       services:
  12.         - name: blog
  13.           port: 8080
  14.   tls:
  15.     certResolver: myresolver

File (YAML)

  1. ## Dynamic configuration
  2. http:
  3.   routers:
  4.     blog:
  5.       rule: "Host(`monitoring.yak-bebop.ts.net`) && Path(`/metrics`)"
  6.       tls:
  7.         certResolver: myresolver

File (TOML)

  1. ## Dynamic configuration
  2. [http.routers]
  3.   [http.routers.blog]
  4.   rule = "Host(`monitoring.yak-bebop.ts.net`) && Path(`/metrics`)"
  5.   [http.routers.blog.tls]
  6.     certResolver = "myresolver"

Domain from Router’s tls.domain Example

Docker & Swarm

  1. labels:
  2.   - traefik.http.routers.blog.rule=Path(`/metrics`)
  3.   - traefik.http.routers.blog.tls.certresolver=myresolver
  4.   - traefik.http.routers.blog.tls.domains[0].main=monitoring.yak-bebop.ts.net

Docker (Swarm)

  1. deploy:
  2.   labels:
  3.     - traefik.http.routers.blog.rule=Path(`/metrics`)
  4.     - traefik.http.routers.blog.tls.certresolver=myresolver
  5.     - traefik.http.routers.blog.tls.domains[0].main=monitoring.yak-bebop.ts.net

Kubernetes

  1. apiVersion: traefik.io/v1alpha1
  2. kind: IngressRoute
  3. metadata:
  4.   name: blogtls
  5. spec:
  6.   entryPoints:
  7.     - websecure
  8.   routes:
  9.     - match: Path(`/metrics`)
  10.       kind: Rule
  11.       services:
  12.         - name: blog
  13.           port: 8080
  14.   tls:
  15.     certResolver: myresolver
  16.     domains:
  17.       - main: monitoring.yak-bebop.ts.net

File (YAML)

  1. http:
  2.   routers:
  3.     blog:
  4.       rule: "Path(`/metrics`)"
  5.       tls:
  6.         certResolver: myresolver
  7.         domains:
  8.           - main: "monitoring.yak-bebop.ts.net"

File (TOML)

  1. ## Dynamic configuration
  2. [http.routers]
  3.   [http.routers.blog]
  4.     rule = "Path(`/metrics`)"
  5.     [http.routers.blog.tls]
  6.       certResolver = "myresolver"
  7.       [[http.routers.blog.tls.domains]]
  8.         main = "monitoring.yak-bebop.ts.net"

Referencing a certificate resolver

Defining a certificate resolver does not imply that routers are going to use it automatically. Each router or entrypoint that is meant to use the resolver must explicitly reference it.

Domain Definition

A certificate resolver requests certificates for a set of domain names inferred from routers, according to the following:

  • If the router has a tls.domains option set, then the certificate resolver derives this router domain name from the main option of tls.domains.

  • Otherwise, the certificate resolver derives the domain name from any Host() or HostSNI() matchers in the router’s rule.

Tailscale Domain Format

A domain is only considered if it is a Tailscale-specific one—that is, in the form machine-name.domains-alias.ts.net.

Tailscale Certificates Renewal

Traefik automatically tracks the expiry date of each Tailscale certificate it fetches and starts to renew a certificate 14 days before its expiry to match the Tailscale daemon renewal policy.