# Tailscale

Keep the panel off the internet. Run kogut on your tailnet with HTTPS from Tailscale.

The Compose setup runs kogut in Tailscale's network namespace, and Tailscale proxies
HTTPS to kogut on loopback.

## Deploy

1. In the Tailscale admin console, enable **MagicDNS** and **HTTPS certificates**.
   Create an auth key under **Settings → Keys**.

2. Download the Compose and Serve files:

   ```sh
   curl -fsSLO https://raw.githubusercontent.com/piotrkowski/kogut/main/deploy/docker/tailscale.compose.yml
   curl -fsSLO https://raw.githubusercontent.com/piotrkowski/kogut/main/deploy/docker/tailscale-serve.json
   ```

3. Put the key in `.env` and keep that file out of git:

   ```sh title=".env"
   TS_AUTHKEY=tskey-auth-...
   ```

4. Add your tailnet URL to the `kogut` service's `environment` list:

   ```yaml
   - KOGUT_URL=https://kogut.<tailnet>.ts.net
   ```

5. Start the services:

   ```sh
   docker compose -f tailscale.compose.yml up -d
   ```

6. From a device on the tailnet, open `https://kogut.<tailnet>.ts.net` and create your
   account with the setup token from the log:

   ```sh
   docker compose -f tailscale.compose.yml logs kogut | grep setup_token
   ```

Tailscale ACLs control access to the device, and kogut's [roles](https://docs.kogut.dev/sign-in/roles/)
access inside the panel.

## Sign in as your Tailscale user

Create the first account with your Tailscale login as the email address. Then add to
`kogut.toml`:

```toml title="kogut.toml"
[auth.proxy]
trusted_proxies = ["127.0.0.1", "::1"]
preset = "tailscale"
```

To mount the file, see [Docker configuration](https://docs.kogut.dev/installation/docker/#configuration). New users become
viewers. Add other admins in **Settings → People** with their Tailscale login and an
empty password before their first visit. See
[Forward auth](https://docs.kogut.dev/sign-in/forward-auth/#tailscale) for the trust rules.

## Connect agents

Use the command from **Hosts → Add a server** with the tailnet HTTPS URL:

```sh
curl -fsSL https://kogut.dev/install | sh -s -- agent --server https://kogut.<tailnet>.ts.net --token <token>
```

Each agent needs access to the tailnet.

## Publish selected endpoints

To accept traffic from outside the tailnet, publish only the paths in
[Paths outside the gate](https://docs.kogut.dev/sign-in/forward-auth/#paths-outside-the-gate) through a
public reverse proxy or Tailscale Funnel. With a status domain, publish that whole
domain, not the panel domain.

For Funnel, configure handlers for only the public paths in `tailscale-serve.json` and
allow Funnel on port 443 in the tailnet policy. Funnel exposes the whole listener, so
remove the panel's `/` handler first. See
[Tailscale Funnel](https://tailscale.com/docs/features/tailscale-funnel).

Keep a notification channel that reaches you outside the tailnet, such as ntfy or
Telegram.