Tailscale is great, and very handy to edit my compose files from, for example, work. But I didn’t think I could use it to access my services?
Tailscale has two features that, when enabled, will let you exit the tailnet through a node to a LAN (subnets) or to the Internet (exit node).
You can use the subnets feature. You can install a Tailscale container on the NAS, mark it as using the subnets feature, and then you have two options:
Use the “host” network mode on the Tailscale container, which will give it access to your NAS machine’s host network interfaces, and set up the subnet mask to your LAN’s subnet. You will be able to access your services on the NAS’s LAN IP and whatever service ports you expose to the host, just as if you were on the LAN.
You leave the Tailscale container to use a private docker network, you create a “tailscale” docker network, you declare the Tailscale subnet as the docker network subnet, and you connect to it the Tailscale container plus any other containers that you want to access (in their docker compose files). This is more secure (in the absolute, abstract sense) because Tailscale traffic doesn’t pass through the LAN, and you only expose a short explicit list of containers to Tailnet. On the other hand you have to juggle container network names, and it just makes things more complicated.