Architecture: Tailscale Networking

arch-tailscale Doc

architecture networking tailscale

Project

Tailscale Networking Conventions

Public Domain Architecture

Public domains (e.g. westsidekingsandqueens.com) are served via a Hetzner edge-proxy running Caddy for TLS termination (Let's Encrypt ACME). Caddy reverse-proxies to the Tailscale funnel hostname (e.g. westside-basketball.tail5b443a.ts.net:443) on the k8s cluster.

Funnel Ingress Pattern

Each service gets a Tailscale Funnel ingress in its k8s namespace, managed via kustomize overlays in pal-e-deployments. The dev overlay has the ingress pattern to follow. Prod overlays need explicit funnel ingress files.

Two-Hop TLS

Client → Caddy (Let's Encrypt cert) → Tailscale funnel (Tailscale cert) → k8s service. The Caddy Caddyfile on the edge-proxy must have a site block for the public domain pointing to the correct tailnet hostname.

DNS

Public domain DNS (GoDaddy) A records point to the Hetzner edge-proxy IP. Tailnet hostnames are managed by Tailscale automatically.