Tailscale funnel

[TOC] 
 Overview 
 Tailscale Funnel is an excellent, free way to bypass CGNAT and expose a local service to the public internet. It handles the reverse proxying, TLS certificate provisioning (via Let's Encrypt), and public DNS routing for you. 
 Steps 
 Phase 1: Prepare the Proxmox LXC (Enable TUN) 
 
 
 SSH into your Proxmox Host (do not enter the container yet). 
 
 
 Open the configuration file for your LXC container (ID 101): 
 nano /etc/pve/lxc/101.conf
 
 
 
 Add the following two lines to the bottom of the file. This passes the tun device from the host to the container (if you are on an older Proxmox 6 setup, use cgroup instead of cgroup2 ): 
 lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file
 
 
 
 Save and exit ( Ctrl+X , Y , Enter ), then restart the container to apply the changes: 
 pct restart 101
 
 
 
 Phase 2: Install and Authenticate Tailscale 
 
 
 Enter your LXC container's console: 
 pct enter 101
 
 
 
 Install Tailscale using their automated script: 
 curl -fsSL https://tailscale.com/install.sh | sh
 
 
 
 Start Tailscale: 
 tailscale up
 
 
 
 Click the link provided in the terminal to authenticate the BookStack node to your Tailscale account. 
 
 
 Phase 3: Enable Funnel in your Tailscale Admin Console 
 Tailscale disables public Funnels by default for security. You must authorize it in your Tailnet settings. 
 
 
 Go to the Tailscale Admin Console in your web browser. 
 
 
 Go to the DNS tab and ensure both MagicDNS and HTTPS Certificates are enabled. 
 
 
 Go to the Access Controls tab. Scroll down to the "nodeAttrs" section (or add it if it's missing) and grant the funnel attribute to your devices. It should look like this: 
 "nodeAttrs": [
 {
 "target": ["autogroup:member"],
 "attr": ["funnel"]
 }
],
 
 
 
 Save the Access Controls. 
 
 
 Phase 4: Start the Tailscale Funnel 
 Back in your LXC container's terminal: 
 
 
 Determine the local port BookStack is running on (typically 80 if served via Nginx/Apache without local SSL). 
 
 
 Route public internet traffic to that local port, running the process in the background ( --bg ): 
 tailscale funnel --bg 80
 
 
 
 Check the status of your Funnel to get your new public web address: 
 tailscale funnel status
 
 
 
 
 [!NOTE]
You will see an output with a URL like: https://your-node.tailnet-name.ts.net . 
 
 Phase 5: Update BookStack's Configuration 
 BookStack uses absolute URLs for CSS, images, and internal links. If you don't update BookStack to recognize its new public URL, the site will look broken and you won't be able to log in. 
 
 
 Navigate to your BookStack directory inside the container (usually /var/www/bookstack or /opt/bookstack ). 
 
 
 Edit the .env configuration file: 
 nano .env
 
 
 
 Find the APP_URL variable and update it to exactly match your new Tailscale URL (make sure it starts with https:// and has no trailing slash): 
 APP_URL=https://your-node.tailnet-name.ts.net
 
 
 
 Save and exit, then clear BookStack's cache to force the changes: 
 php artisan config:clear
php artisan cache:clear
 
 
 
 
 [!TIP]
For a visual walkthrough of the container preparation steps, Configuring Tailscale on an unprivileged Proxmox LXC explains how the TUN device passthrough works under the hood.