Tailscale for Home Assistant (app)

About

Tailscale is an app that connects a Home Assistant instance to a Tailscale VPN network without manual configuration. It links the instance with servers, computers and cloud instances on one private network, even across firewalls or subnets. A Tailscale account is required, and authentication is finished in the app's own web page, which opens in the Home Assistant sidebar. Options cover accepting DNS settings from the tailnet, accepting subnet routes advertised by other nodes, advertising the instance as an app connector, and advertising it as an exit node. An exit node can route public internet traffic like a consumer VPN, but it cannot be combined with using another exit node. It needs Home Assistant OS, runs on aarch64 and amd64, and uses the host network with extended system rights.

Automatic summary of the docs and configuration of hassio-addons/repository. Something wrong, or are you the maintainer and want your own text here? Get in touch

Supports

Opens in the sidebar Its own page opens inside Home Assistant.
Actively maintained Its author released or pushed a change in the last six months.

Setting it up

Add its app repository under Settings, Apps, then install and start it.

From the docs

Tailscale is a zero config VPN, which installs on any device in minutes, including your Home Assistant instance.
Create a secure network between your servers, computers, and cloud instances. Even when separated by firewalls or subnets, Tailscale just works. Tailscale manages firewall rules for you, and works from anywhere you are.

From the docs of hassio-addons/repository, MIT License. Shortened.

Permissions

Host networkUses the host's network directly instead of its own.
Extra system rightsAsks for privileged Linux capabilities.
Hardware accessCan reach USB, serial or GPIO devices.
Supervisor APICan talk to the Supervisor, which manages apps and the system.

Configuration

Accept DNSThis option allows you to accept DNS settings of your tailnet that are configured on the DNS page of the admin console. This option is enabled by default.
Accept routesThis option allows you to accept subnet routes advertised by other nodes in your tailnet. This option is disabled by default.
Advertise as an app connectorWhen you use an app connector, you specify which applications you wish to make accessible over your tailnet, and the domains for those applications. Any traffic for that application is then forced over the tailnet to a node running an app connector before egressing to the target domains. This option is disabled by default.
Advertise as an exit nodeThis option allows you to advertise this Tailscale instance as an exit node. By setting a device on your network as an exit node, you can use it to route all your public internet traffic as needed, like a consumer VPN. This option is disabled by default.
Advertise subnet routesThis option allows you to advertise routes to subnets (accessible on the network your device is connected to) to other clients on your tailnet.
Advertise tagsThis option allows you to specify specific ACL tags for this Tailscale instance. They need to start with tag:.
Always use DERP connectionWhen enabled forces all peer communication over DERP by disabling the use of UDP. This option is disabled by default.
Use exit nodeThis option allows you to specify another Tailscale instance as an exit node for this device. By setting a device on your network as an exit node, you can use it to route all your public internet traffic as needed, like a consumer VPN. This option is unused by default.
Log suppressionThis option allows you to suppress Tailscale's log messages in the app's log after 200 lines. Turn it off only in case you are troubleshooting, because Tailscale is quite chatty. This option is enabled by default.
Log uploadControls Tailscale's client log upload to log.tailscale.com. Enable it if your tailnet policy/Admin Console requires client log upload, otherwise Tailscale and the app can refuse to start. This option is disabled by default.
Login serverThis option allows you to specify a custom control server for this Tailscale instance, for example, a self-host Headscale instance. By default, it uses the control server provided by Tailscale.
Share Home Assistant with Serve or FunnelThis option allows you to enable Tailscale Serve or Funnel features to present your Home Assistant instance with a valid certificate on your tailnet or on the internet. This option is disabled by default.
Share on portThis option lets you specify which port the Tailscale Serve and Funnel features will use to present your Home Assistant instance on the tailnet and on the internet. Only ports 443, 8443, and 10000 are allowed by Tailscale. Port 443 is used by default.
Service hostsThis option allows you to advertise other local services running on this device as Tailscale Services. Each service needs a name, a local target address, a protocol, and a port to expose it on. This option is disabled by default.
Source NAT subnet routesThis option allows subnet devices to see the traffic originating from the subnet router, and this simplifies routing configuration. To support advanced Site-to-site networking (eg. to traverse multiple networks), you can disable this functionality. This option is enabled by default.