### Start and Verify DockTail

Source: https://docktail.org/docs

Commands to launch the stack and verify connectivity.

```bash
docker compose up -d
curl http://myapp.your-tailnet.ts.net
```

--------------------------------

### Web Application Service Example

Source: https://docktail.org/docs

Basic configuration for a web application using direct container IP proxying.

```yaml
services:
  nginx:
    image: nginx:latest
    # No ports needed - DockTail proxies directly to container IP
    labels:
      - "docktail.service.enable=true"
      - "docktail.service.name=web"
      - "docktail.service.port=80"
```

--------------------------------

### Database TCP Service Example

Source: https://docktail.org/docs

Configure a TCP-based service such as a database by specifying the protocol and port.

```yaml
services:
  postgres:
    image: postgres:16
    labels:
      - "docktail.service.enable=true"
      - "docktail.service.name=db"
      - "docktail.service.port=5432"
      - "docktail.service.protocol=tcp"
      - "docktail.service.service-port=5432"
```

--------------------------------

### Expose Multiple Services from One Container

Source: https://docktail.org/docs

Use numbered labels to expose multiple Tailscale services from a single container, ideal for VPN gateway setups.

```yaml
services:
  gluetun:
    image: gluetun:latest
    labels:
      - "docktail.service.enable=true"
      - "docktail.service.name=qbittorrent"
      - "docktail.service.port=8000"
      - "docktail.service.1.name=bitmagnet"
      - "docktail.service.1.port=8001"
```

--------------------------------

### Advertise Tags on Host

Source: https://docktail.org/docs

Command to advertise the required server tags on the host machine.

```bash
sudo tailscale up --advertise-tags=tag:server --reset
```

--------------------------------

### Configure OAuth Credentials

Source: https://docktail.org/docs

Environment variables for OAuth authentication.

```yaml
environment:
  - TAILSCALE_OAUTH_CLIENT_ID=your-client-id
  - TAILSCALE_OAUTH_CLIENT_SECRET=your-client-secret
```

--------------------------------

### Deploy DockTail with Docker Compose

Source: https://docktail.org/docs

Basic configuration for running DockTail alongside a service container.

```yaml
services:
  docktail:
    image: ghcr.io/marvinvr/docktail:latest
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/run/tailscale:/var/run/tailscale
    environment:
      # Optional but recommended - enables auto-service-creation
      - TAILSCALE_OAUTH_CLIENT_ID=${TAILSCALE_OAUTH_CLIENT_ID}
      - TAILSCALE_OAUTH_CLIENT_SECRET=${TAILSCALE_OAUTH_CLIENT_SECRET}

  myapp:
    image: nginx:latest
    # No ports needed! DockTail proxies directly to container IP
    labels:
      - "docktail.service.enable=true"
      - "docktail.service.name=myapp"
      - "docktail.service.port=80"
```

--------------------------------

### Configure DockTail with Host Tailscale

Source: https://docktail.org/docs

Deployment configuration for environments where Tailscale is already running on the host machine.

```yaml
services:
  docktail:
    image: ghcr.io/marvinvr/docktail:latest
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/run/tailscale:/var/run/tailscale
    environment:
      # Optional but recommended - enables auto-service-creation
      - TAILSCALE_OAUTH_CLIENT_ID=${TAILSCALE_OAUTH_CLIENT_ID}
      - TAILSCALE_OAUTH_CLIENT_SECRET=${TAILSCALE_OAUTH_CLIENT_SECRET}
```

--------------------------------

### Configure Legacy Mode with Published Ports

Source: https://docktail.org/docs

Use legacy mode by setting direct to false, which requires explicit port mapping in the Docker configuration.

```yaml
services:
  app:
    image: myapp:latest
    ports:
      - "8080:3000"  # Required when direct=false
    labels:
      - "docktail.service.enable=true"
      - "docktail.service.name=app"
      - "docktail.service.port=3000"
      - "docktail.service.direct=false"
```

--------------------------------

### Expose Public Website with Funnel

Source: https://docktail.org/docs

Enable public access to a service using the funnel labels, specifying the service and funnel ports.

```yaml
services:
  website:
    image: nginx:latest
    labels:
      - "docktail.service.enable=true"
      - "docktail.service.name=website"
      - "docktail.service.port=80"
      - "docktail.service.service-port=443"
      - "docktail.funnel.enable=true"
      - "docktail.funnel.port=80"
```

--------------------------------

### Configure API Key Authentication

Source: https://docktail.org/docs

Environment variable for API key authentication.

```yaml
environment:
  - TAILSCALE_API_KEY=tskey-api-...
```

--------------------------------

### Deploy DockTail with Tailscale Sidecar

Source: https://docktail.org/docs

Deployment configuration for environments without host-level Tailscale, using a sidecar container.

```yaml
services:
  tailscale:
    image: tailscale/tailscale:latest
    hostname: docktail-host
    environment:
      - TS_AUTHKEY=${TAILSCALE_AUTH_KEY}
      - TS_EXTRA_ARGS=--advertise-tags=tag:server
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_SOCKET=/var/run/tailscale/tailscaled.sock
    volumes:
      - tailscale-state:/var/lib/tailscale
      - tailscale-socket:/var/run/tailscale
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    network_mode: host
    restart: unless-stopped

  docktail:
    image: ghcr.io/marvinvr/docktail:latest
    depends_on:
      - tailscale
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - tailscale-socket:/var/run/tailscale
    environment:
      # Optional but recommended - enables auto-service-creation
      - TAILSCALE_OAUTH_CLIENT_ID=${TAILSCALE_OAUTH_CLIENT_ID}
      - TAILSCALE_OAUTH_CLIENT_SECRET=${TAILSCALE_OAUTH_CLIENT_SECRET}

volumes:
  tailscale-state:
  tailscale-socket:
```

--------------------------------

### Define Docker Service Labels

Source: https://docktail.org/docs

Use labels to enable DockTail service discovery. Direct proxying to container IPs is the default behavior.

```yaml
services:
  myapp:
    image: nginx:latest
    # No ports needed!
    labels:
      - "docktail.service.enable=true"
      - "docktail.service.name=myapp"
      - "docktail.service.port=80"
```

--------------------------------

### Configure Custom Docker Network

Source: https://docktail.org/docs

Specify a custom Docker network for the service using the docktail.service.network label.

```yaml
services:
  app:
    image: myapp:latest
    networks:
      - backend
    labels:
      - "docktail.service.enable=true"
      - "docktail.service.name=app"
      - "docktail.service.port=3000"
      - "docktail.service.network=backend"

networks:
  backend:
```

--------------------------------

### HTTPS Service with Auto TLS

Source: https://docktail.org/docs

Configure a service for HTTPS by setting the service-port to 443. Delete existing services from the Tailscale panel if switching protocols.

```yaml
services:
  api:
    image: myapi:latest
    labels:
      - "docktail.service.enable=true"
      - "docktail.service.name=api"
      - "docktail.service.port=3000"
      - "docktail.service.service-port=443"  # Auto-enables HTTPS
```

--------------------------------

### Configure ACLs for DockTail

Source: https://docktail.org/docs

Define tag owners and auto-approvers in your Tailscale ACLs to allow service advertisement. Ensure all tags are defined in tagOwners to avoid rejection during GitOps deployments.

```json
{
  "tagOwners": {
    "tag:server": ["autogroup:admin"],
    "tag:container": ["tag:server"]
  },
  "autoApprovers": {
    "services": {
      "tag:container": ["tag:server"]
    }
  }
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.