# Home Assistant Community Add-on: Tailscale Tailscale is a zero config VPN, which installs on any device in minutes, including your Home Assistant instance. Create a secure network between your servers, computers, and cloud instances. Even when separated by firewalls or subnets, Tailscale just works. Tailscale manages firewall rules for you, and works from anywhere you are. ## Prerequisites In order to use this add-on, you'll need a Tailscale account. It is free to use for personal & hobby projects, up to 100 clients/devices on a single user account. Sign up using your Google, Microsoft or GitHub account at the following URL: You can also create an account during the add-on installation processes, however, it is nice to know where you need to go later on. ## Installation 1. Click the Home Assistant My button below to open the add-on on your Home Assistant instance. [![Open this add-on in your Home Assistant instance.][addon-badge]][addon] 1. Click the "Install" button to install the add-on. 1. Start the "Tailscale" add-on. 1. Check the logs of the "Tailscale" add-on to see if everything went well. 1. Open the Web UI of the "Tailscale" add-on to complete authentication and couple your Home Assistant instance with your Tailscale account. **Note:** Some browsers don't work with this step. It is recommended to complete this step on a desktop or laptop computer using the Chrome browser. 1. Done! ## Configuration This add-on has almost no additional configuration options for the add-on itself. However, when logging in to Tailscale, you can configure your Tailscale network right from their interface. The add-on exposes "Exit Node" capabilities that you can enable from your Tailscale account. Additionally, if the Supervisor managed your network ( which is the default), the add-on will also advertise routes to your subnets on all supported interfaces to Tailscale. Consider disabling key expiry to avoid losing connection to your Home Assistant device. See [Key expiry][tailscale_info_key_expiry] for more information. ```yaml accept_dns: true advertise_exit_node: true log_level: info login_server: "https://controlplane.tailscale.com" tags: - tag:example - tag:homeassistant taildrop: true proxy: true ``` ### Option: `accept_dns` If you are experiencing trouble with MagicDNS on this device and wish to disable, you can do so using this option. When not set, this option is enabled by default. MagicDNS may cause issues if you run things like Pi-hole or AdGuard Home on the same machine as this add-on. In such cases disabling `accept_dns` will help. You can still leverage MagicDNS on other devices on your network, by adding `100.100.100.100` as a DNS server in your Pi-hole or AdGuard Home. ### Option: `advertise_exit_node` This option allows you to advertise this Tailscale instance as an exit node. By setting a device on your network as an exit node, you can use it to route all your public internet traffic as needed, like a consumer VPN. More information: When not set, this option is enabled by default. ### Option: `log_level` Optionally enable tailscaled debug messages in the add-on's log. Turn it on only in case you are troubleshooting, because Tailscale's daemon is quite chatty. The `log_level` option controls the level of log output by the addon and can be changed to be more or less verbose, which might be useful when you are dealing with an unknown issue. Possible values are: - `trace`: Show every detail, like all called internal functions. - `debug`: Shows detailed debug information. - `info`: Normal (usually) interesting events. - `notice`: Normal but significant events. - `warning`: Exceptional occurrences that are not errors. - `error`: Runtime errors that do not require immediate action. - `fatal`: Something went terribly wrong. Add-on becomes unusable. Please note that each level automatically includes log messages from a more severe level, e.g., `debug` also shows `info` messages. By default, the `log_level` is set to `info`, which is the recommended setting unless you are troubleshooting. ### Option: `login_server` This option lets you specify you to specify a custom control server instead of the default (`https://controlplane.tailscale.com`). This is useful if you are running your own Tailscale control server, for example, a self-hosted [Headscale] instance. ### Option: `tags` This option allows you to specify specific ACL tags for this Tailscale instance. They need to start with `tag:`. More information: ### Option: `taildrop` This add-on support [Tailscale's Taildrop][taildrop] feature, which allows you to send files to your Home Assistant instance from other Tailscale devices. When not set, this option is enabled by default. Received files are stored in the `/share/taildrop` directory. ### Option: `proxy` When not set, this option is enabled by default. Tailscale can provide a TLS certificate for your Home Assistant instance within your tailnet domain. This can prevent browsers from warning that HTTP URLs to your Home Assistant instance look unencrypted (browsers are not aware of the connections between Tailscale nodes are secured with end-to-end encryption). More information: [Enabling HTTPS][tailscale_info_https] 1. Configure Home Assistant to be accessible through an HTTP connection (this is the default). See [HTTP integration documentation][http_integration] for more information. If you still want to use another HTTPS connection to access Home Assistant, please use a reverse proxy add-on. 1. Home Assistant, by default, blocks requests from reverse proxies, like the Tailscale Proxy. To enable it, add the following lines to your `configuration.yaml`, without changing anything: ```yaml http: use_x_forwarded_for: true trusted_proxies: - 127.0.0.1 ``` 1. Navigate to the [DNS page][tailscale_dns] of the admin console: - Choose a Tailnet name. - Enable MagicDNS if not already enabled. - Under HTTPS Certificates section, click Enable HTTPS. 1. Restart the add-on. **Note:** _You should not use any port number in the URL that you used previously to access Home Assistant. Tailscale Proxy works on the default HTTPS port 443._ ## Changelog & Releases This repository keeps a change log using [GitHub's releases][releases] functionality. Releases are based on [Semantic Versioning][semver], and use the format of `MAJOR.MINOR.PATCH`. In a nutshell, the version will be incremented based on the following: - `MAJOR`: Incompatible or major changes. - `MINOR`: Backwards-compatible new features and enhancements. - `PATCH`: Backwards-compatible bugfixes and package updates. ## Support Got questions? You have several options to get them answered: - The [Home Assistant Community Add-ons Discord chat server][discord] for add-on support and feature requests. - The [Home Assistant Discord chat server][discord-ha] for general Home Assistant discussions and questions. - The Home Assistant [Community Forum][forum]. - Join the [Reddit subreddit][reddit] in [/r/homeassistant][reddit] You could also [open an issue here][issue] GitHub. ## Authors & contributors The original setup of this repository is by [Franck Nijhof][frenck]. For a full list of all authors and contributors, check [the contributor's page][contributors]. ## License MIT License Copyright (c) 2021-2023 Franck Nijhof Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. [addon-badge]: https://my.home-assistant.io/badges/supervisor_addon.svg [addon]: https://my.home-assistant.io/redirect/supervisor_addon/?addon=a0d7b954_tailscale&repository_url=https%3A%2F%2Fgithub.com%2Fhassio-addons%2Frepository [contributors]: https://github.com/hassio-addons/addon-tailscale/graphs/contributors [discord-ha]: https://discord.gg/c5DvZ4e [discord]: https://discord.me/hassioaddons [forum]: https://community.home-assistant.io/?u=frenck [frenck]: https://github.com/frenck [headscale]: https://github.com/juanfont/headscale [http_integration]: https://www.home-assistant.io/integrations/http/ [issue]: https://github.com/hassio-addons/addon-tailscale/issues [reddit]: https://reddit.com/r/homeassistant [releases]: https://github.com/hassio-addons/addon-tailscale/releases [semver]: https://semver.org/spec/v2.0.0.html [taildrop]: https://tailscale.com/taildrop/ [tailscale_dns]: https://login.tailscale.com/admin/dns [tailscale_info_https]: https://tailscale.com/kb/1153/enabling-https/ [tailscale_info_key_expiry]: https://tailscale.com/kb/1028/key-expiry/