kogutdocs

    Type to search page titles, headings and text.

    Installation

    Tailscale

    Keep the panel off the internet. Run kogut on your tailnet with HTTPS from Tailscale.

    The Compose setup runs kogut in Tailscale’s network namespace, and Tailscale proxies HTTPS to kogut on loopback.

    Deploy

    1. In the Tailscale admin console, enable MagicDNS and HTTPS certificates. Create an auth key under Settings → Keys.

    2. Download the Compose and Serve files:

      curl -fsSLO https://raw.githubusercontent.com/piotrkowski/kogut/main/deploy/docker/tailscale.compose.yml
curl -fsSLO https://raw.githubusercontent.com/piotrkowski/kogut/main/deploy/docker/tailscale-serve.json

    3. Put the key in .env and keep that file out of git:

      .env
      TS_AUTHKEY=tskey-auth-...

    4. Add your tailnet URL to the kogut service’s environment list:

      - KOGUT_URL=https://kogut.<tailnet>.ts.net

    5. Start the services:

      docker compose -f tailscale.compose.yml up -d

    6. From a device on the tailnet, open https://kogut.<tailnet>.ts.net and create your account with the setup token from the log:

      docker compose -f tailscale.compose.yml logs kogut | grep setup_token

    Tailscale ACLs control access to the device, and kogut’s roles access inside the panel.

    Sign in as your Tailscale user

    Create the first account with your Tailscale login as the email address. Then add to kogut.toml:

    kogut.toml
    [auth.proxy]
trusted_proxies = ["127.0.0.1", "::1"]
preset = "tailscale"

    To mount the file, see Docker configuration. New users become viewers. Add other admins in Settings → People with their Tailscale login and an empty password before their first visit. See Forward auth for the trust rules.

    Connect agents

    Use the command from Hosts → Add a server with the tailnet HTTPS URL:

    curl -fsSL https://kogut.dev/install | sh -s -- agent --server https://kogut.<tailnet>.ts.net --token <token>

    Each agent needs access to the tailnet.

    Publish selected endpoints

    To accept traffic from outside the tailnet, publish only the paths in Paths outside the gate through a public reverse proxy or Tailscale Funnel. With a status domain, publish that whole domain, not the panel domain.

    For Funnel, configure handlers for only the public paths in tailscale-serve.json and allow Funnel on port 443 in the tailnet policy. Funnel exposes the whole listener, so remove the panel’s / handler first. See Tailscale Funnel.

    Keep a notification channel that reaches you outside the tailnet, such as ntfy or Telegram.