So lost

[Welsyntoffie]

I am so lost at the moment about https serving and services, I read so many post that I am confused at hell..

Was following this guide... https://tailscale.com/blog/docker-tailscale-guide
I substituted mailie for home assistant.
From my windows 10 pc with tailscale connected I can access tailhostname:8123 and via https with tailscale disconnected. GREAT.
I then noticed I can not add my MYSENSORS ESP32 node 172.22.2.100 on my local lan. So I tried 172.22.2.111:8123 and could not get into home assistant. So with the guide example local LAN access does not work.
I added network_mode=host and - TS_ROUTES=172.22.2.0/24. This worked for all 3 cases. Tailnet, https and local LAN and I could add my esp32. System worked.
I added grafana charts in my home assistant. Works over local lan, but not when home assistant is served over https.
So I used the above guide to make grafana https as well. The network_mode=host in this case prevented https access as tailscale0 network is busy already. Both of these uses different folders for the state.
I have 5 containers that I want to be able to access over https and local lan.
Can anyone please help with a possible solution. I looked through caddy and reverse proxies, and all I can see is sjkdhfkjsdfisdhfjksdhfkjsdhfjk.

version: "3.7"
services:
  ts-vpn:
    image: tailscale/tailscale:latest
    container_name: ts-vpn
    hostname: ts-vpn
    network_mode: host

    environment:
      - TS_AUTHKEY=tskey-client-hidden?ephemeral=false
#      - "TS_EXTRA_ARGS=--advertise-tags=tag:container --reset"
      - "TS_EXTRA_ARGS=--advertise-tags=tag:container --accept-routes"
      - TS_SERVE_CONFIG=/config/hass.json
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_USERSPACE=false
      - TS_ROUTES=172.22.2.0/24
    volumes:
      - /home/pieter/dockerdata/test/state:/var/lib/tailscale
      - /home/pieter/dockerdata/test/con1:/config
#      - /dev/net/tun:/dev/net/tun
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
      - NET_RAW
#      - net_admin
#      - sys_module

  hass-configurator:
    image: "causticlab/hass-configurator-docker:latest"
    restart: always
    ports:
      - "3218:3218/tcp"
    volumes:
      - "/home/pieter/dockerdata/fileeditor/configurator-config:/config"
      - "/home/pieter/dockerdata/homeassistant:/hass-config"

  homeassistant:
    container_name: homeassistant2
    image: 
    volumes:
      - /home/pieter/dockerdata/homeassistant:/config
      - /etc/localtime:/etc/localtime:ro
      - /run/dbus:/run/dbus:ro
    restart: unless-stopped
    depends_on:
      - ts-vpn
    privileged: true
    network_mode: container:ts-vpn
    
volumes:
  ts-vpn:
    driver: localghcr.io/home-assistant/home-assistant:stable

GRAFAN TRY

version: '3.6'
services:
  influxdb:
    image: influxdb:latest
    container_name: influxdb
    restart: unless-stopped
    ports:
      - '8086:8086'
    volumes:
      - /mnt/media/influxdb:/var/lib/influxdb2


  ts-grafana:
    image: tailscale/tailscale:latest
    container_name: ts-grafana
    hostname: ts-grafana
    network_mode: host

    environment:
      - TS_AUTHKEY=tskey-client-hidden?ephemeral=false
#      - "TS_EXTRA_ARGS=--advertise-tags=tag:container --reset"
      - "TS_EXTRA_ARGS=--advertise-tags=tag:container --accept-routes"
      - TS_SERVE_CONFIG=/config/grafana.json
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_USERSPACE=true
      - TS_ROUTES=172.22.2.0/24
    volumes:
      - /home/pieter/dockerdata/grafana/tailscale/:/var/lib/tailscale
      - /home/pieter/dockerdata/grafana/tailscale/config:/config
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
      - NET_RAW
#      - net_admin
#      - sys_module

# Grafana - Graphical data visualization
  grafana:
    image: grafana/grafana-enterprise:10.4.2-ubuntu
    container_name: grafana
#   security_opt:
#     - no-new-privileges:false
    restart: unless-stopped
    depends_on:
      - influxdb
#      - ts-grafana
#   networks:
#     - default
#    network_mode: container:ts-grafana
#    ports:
#      - "3001:3000"
    user: $PUID
    volumes:
      - /home/pieter/dockerdata/grafana:/var/lib/grafana

    environment:
      GF_INSTALL_PLUGINS: "grafana-clock-panel,grafana-simple-json-datasource,grafana-worldmap-panel,grafana-piechart-panel"
      GF_AUTH_ANONYMOUS_ENABLED: "true"
      GF_SECURITY_ALLOW_EMBEDDING: "true"
      GF_INGRESS_USER: anonymous
#     GF_SECURITY_COOKIE_SAMESITE: none
#     GF_SECURITY_COOKIE_SECURE: "true"
      GF_SECURITY_LOGIN_REMEMBER_DAYS: "365"
      GF_DATE_FORMATS_INTERVAL_HOUR: DD/MM HH:mm
      GF_DATE_FORMATS_INTERVAL_DAY: DD/MM
#     GF_AUTH_BASIC_ENABLED: "true"

[hollie]

Hey Kristof,

in your example you are using the Tailscale container, not the tailscale-caddy-proxy.

The solution you are searching for can be implemented using the tailscale-caddy-proxy.

The best advice I can give you is to take the example docker-compose file that comes with this project, see if you can reacht the whoami example and then replace the whoami container with your application container as a first step.

For more services, as stated: just spin up a different tailscale-caddy-proxy per service you want to make available.

Regards,
Lieven

[Welsyntoffie]

Thank you that was something else from a different post I was attempting.