Post #1631346

Tonight's @homelab adventure has been converting one weird bespoke thing to another weird bespoke thing. I have a handful of docker services that I want to be able to connect to remotely but I don't want to expose their ports to every interface. Previously, I was pushing the node's tailnet ip into a TAILNET_IP env var and then publishing the port like this: - ${TAILNET_IP}:9100:9100 That kind of sucks, though, because it means the service is dependent on tailscale to start up, even if that port is only for metrics or whatever. Tonight I taught my deploy harness to generate a tailscale serve raw config for the host that I set with `ssh root@host tailscale serve set-raw` after the deploy is done. Then switched all of the instances of the above syntax to : - 127.0.0.1:9100:9100 This exposes them to localhost, which is still as secure as before because the docker host could always access the container IP directly. Pretty happy with the result. One less thing for containers to directly depend on. #homelab #selfhosted