How to set up Tailscale

Zero-config mesh VPN. This guide covers how to access it, log in for the first time, configure the basics, and where its data lives so you can back it up.

1. What is Tailscale?

Access all your SparkBox services from anywhere without port forwarding, dynamic DNS, or firewall rules. Tailscale creates a secure mesh network between your devices using WireGuard under the hood. Share access with family or friends by sharing nodes on your tailnet.

2. Before you start

Two one-time setup steps in your Tailscale admin console before this works: (1) at https://login.tailscale.com/admin/settings/features enable 'HTTPS Certificates' (older consoles also show a separate 'Tailscale Serve' toggle — enable it too if you see it; current consoles only have HTTPS Certificates). (2) Generate an auth key at https://login.tailscale.com/admin/settings/keys (reusable, 90 days). Full walkthrough at https://tomsparkbox.com/docs.html#remote-access-tailscale

3. Settings you can change

You can set these when you enable the module, or later from Apps → Tailscale in the dashboard:

• Tailscale Auth Key — Paste your Tailscale auth key here (starts with 'tskey-auth-'). Get one at https://login.tailscale.com/admin/settings/keys — use a reusable key if you want the container to reconnect automatically after restarts. NOTE: also make sure 'HTTPS Certificates' is enabled at login.tailscale.com/admin/settings/features — otherwise the module installs but tailnet HTTPS silently won't work.

4. Where your data lives

Tailscale's config and persistent data are stored on the SparkBox host under:

/opt/sparkbox/modules/tailscale/config/

Backups via the SparkBox dashboard's Backup tile include this directory by default, so a single restore brings Tailscale back to its current state on a fresh install.

5. Custom serve / Funnel setups

SparkBox re-applies its own serve configuration every time the Tailscale container starts, so anything you add by hand with the tailscale serve or tailscale funnel CLI gets reset on the next update or restart — the classic symptom is a Funnel that works all day and silently drops back to private overnight. To make custom entries permanent, declare them in /opt/sparkbox/modules/tailscale/serve.user.json instead (SparkBox v1.6.211+); SparkBox merges that file into its generated config on every regeneration. Full walkthrough with an example: Custom serve & Funnel in the docs.

Next steps