{"id":31119099,"url":"https://github.com/frnwtr/tailwhale","last_synced_at":"2026-05-01T18:33:12.313Z","repository":{"id":314921049,"uuid":"1057204357","full_name":"frnwtr/tailwhale","owner":"frnwtr","description":"Automates Tailscale + Traefik integration for Docker. Auto-discover containers, issue TLS certs, update Traefik configs, and expose services via MagicDNS or Funnel. Includes CLI, Docker plugin \u0026 optional UI.","archived":false,"fork":false,"pushed_at":"2025-09-15T16:49:47.000Z","size":71,"stargazers_count":0,"open_issues_count":7,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-09-15T17:41:59.826Z","etag":null,"topics":["docker","docker-compose","tailscale"],"latest_commit_sha":null,"homepage":"https://tailwhale.sh","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/frnwtr.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2025-09-15T12:14:53.000Z","updated_at":"2025-09-15T16:08:14.000Z","dependencies_parsed_at":"2025-09-16T22:17:48.297Z","dependency_job_id":null,"html_url":"https://github.com/frnwtr/tailwhale","commit_stats":null,"previous_names":["frnwtr/tailwhale"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/frnwtr/tailwhale","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/frnwtr%2Ftailwhale","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/frnwtr%2Ftailwhale/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/frnwtr%2Ftailwhale/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/frnwtr%2Ftailwhale/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/frnwtr","download_url":"https://codeload.github.com/frnwtr/tailwhale/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/frnwtr%2Ftailwhale/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32508901,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-30T13:12:12.517Z","status":"online","status_checked_at":"2026-05-01T02:00:05.856Z","response_time":64,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker","docker-compose","tailscale"],"created_at":"2025-09-17T13:03:19.268Z","updated_at":"2026-05-01T18:33:12.280Z","avatar_url":"https://github.com/frnwtr.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# TailWhale\n\n![CI](https://github.com/frnwtr/tailwhale/actions/workflows/ci.yml/badge.svg)\n![PR Template Check](https://github.com/frnwtr/tailwhale/actions/workflows/pr-template-check.yml/badge.svg)\n\nA tool to automatically sync **Tailscale certificates**, **Traefik routing**, and optionally **DNS/Funnel exposure** for Docker containers — expose services over your tailnet or Internet via HTTPS, with zero manual label editing required.  \n\n---\n\n## 🎯 What is it\n\nTailWhale is a sidecar/companion service + CLI + optional UI that runs alongside Docker \u0026 Traefik.  \n\nIt watches your Docker environment, identifies containers you want to expose, uses **Tailscale** to issue SSL certificates, and updates a `tls.yml` file that Traefik watches (hot reloaded).  \n\nWith **MagicDNS** enabled, TailWhale generates hostnames for your containers so they are reachable inside the tailnet.  \nWith **Funnel**, you can expose Traefik itself directly on the Internet with HTTPS automatically handled by Tailscale.  \n\nOfficial website: [https://tailwhale.sh](https://tailwhale.sh)  \n\n---\n\n## ⚙️ Features\n\n- 🔍 Auto-discovery of containers to expose  \n- 🔐 Automatic certificate issuance via Tailscale  \n- 🔄 Dynamic Traefik TLS config (hot reload)  \n- 🖥 CLI \u0026 Daemon (watch mode)  \n- 🌐 Optional Web UI / Docker Desktop Extension  \n- 🌱 MagicDNS integration  \n- 🐳 Three exposure modes:  \n  - **Mode A**: Host + Traefik (default)  \n  - **Mode B**: Per-container sidecar  \n  - **Mode C**: Funnel on Traefik (public exposure)  \n\n---\n\n## 🔍 Modes Explained\n\n### Mode A — Host + Traefik\n- One Tailscale node (the host).  \n- Containers exposed via Traefik routing.  \n- Hostname pattern:  \n  ```\n  \u003ccontainer\u003e.\u003chost\u003e.\u003ctailnet\u003e.ts.net\n  ```\n\n### Mode B — Per-Container Sidecar\n- Each container runs its own Tailscale sidecar.  \n- Each container is an independent node.  \n- Hostname pattern:  \n  ```\n  \u003ccontainer\u003e.\u003ctailnet\u003e.ts.net\n  ```\n\n### Mode C — Funnel on Traefik\n- Tailscale Funnel enabled on Traefik container.  \n- Exposes Traefik publicly on Internet with TLS managed by Tailscale.  \n- Hostname pattern:  \n  ```\n  https://\u003chost\u003e.ts.net\n  ```\n\n---\n\n## 🧩 Architecture\n\n- `core/` — discovery, naming, mode selection  \n- `docker/` — container list, events  \n- `tailscale/` — certs, MagicDNS checks, Funnel setup  \n- `traefik/` — TLS file writer (Mode A only)  \n- `cmd/tailwhale` — CLI  \n- `cmd/extension-api` — REST backend for UI  \n- `ui/` — Next.js frontend  \n\n---\n\n## 🚀 Getting Started\n\n### Prerequisites\n- Tailnet with MagicDNS enabled  \n- Tailscale installed on host (Mode A)  \n- Or sidecar Tailscale containers (Mode B)  \n- Or Funnel enabled on host/container (Mode C)  \n\n### CLI usage (current)\n```bash\n# one-off sync: discover → issue cert paths → write traefik/tls.yml\ntailwhale sync \\\n  --host host1 --tailnet tn \\\n  --tls-path traefik/tls.yml --cert-dir /var/lib/tailwhale/certs \n\n# watch: prefer Docker events (when built with tag `docker`), fallback to interval\ntailwhale watch \\\n  --host host1 --tailnet tn \\\n  --tls-path traefik/tls.yml --cert-dir /var/lib/tailwhale/certs \\\n  --interval 10s\n\n# list: show resolved services; load containers from JSON for offline dev\ntailwhale list --json\ntailwhale list --from-file ./examples/containers.json\n```\n\nMakefile demo\n- Run `make demo` to list services from `examples/containers.json` and write a preview TLS file to `/tmp/tailwhale_tls.yml` using `examples/tailwhale.json`.\n\nConfig file (optional)\n- Pass `--config examples/tailwhale.json` to `sync`/`watch` to set `host`, `tailnet`, `tlsPath`, `certDir`.\n- Flag values override file values.\n```json\n{\n  \"host\": \"host1\",\n  \"tailnet\": \"tn\",\n  \"tlsPath\": \"traefik/tls.yml\",\n  \"certDir\": \"/var/lib/tailwhale/certs\"\n}\n```\n\n### Docker CLI plugin usage\n```bash\ndocker tailwhale expose myapp --host myapp.ts.net\ndocker tailwhale list\n```\n\n---\n\n## 🧪 Build Notes\n\n- Default build uses a fake Docker provider (no external deps).  \n- To use the real Docker provider, build with tag `docker`:\n  ```bash\n  go build -tags docker ./cmd/tailwhale\n  ```\n  Watch mode will then react to Docker events and rewrite `tls.yml` atomically.\n\n### Optional TUI (Bubble Tea)\n- A minimal terminal UI is scaffolded behind the `tui` build tag using Bubble Tea.\n- Install deps and build:\n  ```bash\n  # add dependency once (when you want to build the TUI)\n  go get github.com/charmbracelet/bubbletea@latest\n  # build the TUI binary (tagged to avoid affecting default CI builds)\n  go build -tags tui ./cmd/twui\n  ./twui\n  ```\n  The TUI lists discovered services and supports `r` to refresh and `q` to quit.\n\n---\n\n## 🔮 Roadmap\n\n- [ ] Auto certs with Tailscale  \n- [ ] Dynamic TLS config for Traefik  \n- [ ] CLI toggle for exposure mode (A, B, C)  \n- [ ] Funnel automation (start/stop, status)  \n- [ ] UI for toggling exposure per service  \n- [ ] Integration with Tailscale API (MagicDNS, Funnel)  \n- [ ] Docker Desktop Extension packaging  \n- [ ] Metrics \u0026 observability  \n\n---\n\n## 📅 Planning (Gantt)\n\n```mermaid\ngantt\n    title TailWhale Project Timeline\n    dateFormat  YYYY-MM-DD\n    section MVP\n    CLI Skeleton (sync, watch, list)       :a1, 2025-09-15, 14d\n    Auto Certs + TLS File                  :a2, after a1, 14d\n    section v1.0\n    MagicDNS Integration                   :b1, after a2, 14d\n    Funnel Mode Support (Mode C)           :b2, after b1, 14d\n    section v2.0\n    UI / Docker Extension                  :c1, after b2, 21d\n    Tailscale API Advanced (Funnel, DNS)   :c2, after c1, 21d\n    Metrics + Prometheus Exporter          :c3, after c2, 14d\n```ics + Prometheus Exporter          :c3, after c2, 14d\n```\n\n---\n\n## 🛡 License\n\nTailWhale is released under the **MIT License**.  \nSee the [LICENSE](./LICENSE) file for full details.  \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffrnwtr%2Ftailwhale","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffrnwtr%2Ftailwhale","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffrnwtr%2Ftailwhale/lists"}