Tailscale serve: one port limits Supervisor UI access alongside Synapse TLS #1

New issue

Closed

opened 2026-05-16 18:47:27 +00:00 by Mark · 1 comment

Mark commented

2026-05-16 18:47:27 +00:00

Owner

The existing matrix-ts-sidecar already serves Synapse (port 8008) via tailscale serve — only one port is available without additional infrastructure.

Context: The org-subscriber daemon's Supervisor UI needs to be reachable. On tailnet, plain HTTP (http://hostname:9090/ui/) is already encrypted by WireGuard at the transport layer. A TLS-wrapped serve would require one of:

Reverse proxy (Caddy/nginx) in the pod — multiplex both services behind a single serve call
Second Tailscale sidecar with its own hostname
Tailscale Funnel (explicitly vetoed — tailnet-only)

Decision: Deploy without TLS for now — tailnet traffic is already encrypted at the transport layer. Revisit if external access or a browser padlock requirement emerges.

The existing matrix-ts-sidecar already serves Synapse (port 8008) via `tailscale serve` — only one port is available without additional infrastructure. **Context:** The org-subscriber daemon's Supervisor UI needs to be reachable. On tailnet, plain HTTP (`http://hostname:9090/ui/`) is already encrypted by WireGuard at the transport layer. A TLS-wrapped serve would require one of: 1. Reverse proxy (Caddy/nginx) in the pod — multiplex both services behind a single `serve` call 2. Second Tailscale sidecar with its own hostname 3. Tailscale Funnel (explicitly vetoed — tailnet-only) **Decision:** Deploy without TLS for now — tailnet traffic is already encrypted at the transport layer. Revisit if external access or a browser padlock requirement emerges.

Mark added the

blocked:needs-decision

label

2026-05-16 18:47:55 +00:00

Mark closed this issue

2026-05-23 16:50:15 +00:00

Mark commented

2026-05-23 16:50:19 +00:00

Author

Owner

WONTFIX — tailnet traffic is already encrypted at the transport layer by WireGuard. Deploying without TLS is acceptable for now. Revisit if external access or a browser padlock requirement emerges.

**WONTFIX** — tailnet traffic is already encrypted at the transport layer by WireGuard. Deploying without TLS is acceptable for now. Revisit if external access or a browser padlock requirement emerges.