Reverse Proxy and HTTPS for multiple services over Tailscale

matt · June 13, 2022, 4:27am

Looks like Tailscale doesn’t support custom subdomains per-machine yet:

FR: Extend MagicDNS to support subdomains on a machine

opened 10:41PM - 30 Jan 22 UTC

L1 Very few P2 Aggravating T0 New feature fr

### What are you trying to do? I'm trying to access multiple services on the …same machine over http. This machine runs traefik as a reverse proxy which exposes multiple web services over HTTP (port 80). ### How should we solve this? It would be useful if the MagicDNS entries could extend and cover all subdomains on a machine. Example, I have a linux host called server, which exposes two services called service1 and service2, a reverse proxy sits in front of these services and forwards HTTP requests based on hostname so that service1.server goes to service1 and service2.server goes to server2. ### What is the impact of not solving this? The only workaround at the moment is to use different ports for these services and this makes it difficult to work with reverse proxies. Also remembering subdomains is easier than remembering specific port numbers. ### Anything else? _No response_

You’ll either need to use a different port for each service, or route differently based on something in the URI like a sub-path (but beware, many backend apps don’t like being proxied in subfolders).

Actually, you probably could serve on any tailnet Host / domain name that you want (including a subdomain such as service.origin.tailnet-c74e.ts.net) as long as the clients do the following:

Force the DNS to resolve to the machine of interest (origin.tailnet-c74e.ts.net in your case I believe). This might involve running your own DNS server/resolver or hard-coding the resolution IP into clients (for example, curl has a --resolve flag to pin a domain to an IP address manually).
Put origin.tailnet-c74e.ts.net in the ServerName in the ClientHello.
Send the service.origin.tailnet-c74e.ts.net subdomain in the Host header of subsequent HTTP requests. (Caddy won’t allow this if you enable TLS client auth, just FYI.)

So, definitely not convenient… but probably doable in theory?