How to Self-Host Forgejo Privately on a Tailscale Network Using Docker Compose
Developers seeking a private Git hosting solution can run Forgejo entirely within a Tailscale network using Docker Compose, avoiding the need for open ports, public DNS records, or a reverse proxy. The setup uses a sidecar container pattern where a Tailscale container owns a dedicated network namespace and Forgejo is placed inside it via the network_mode directive, giving it its own tailnet identity. This means Forgejo is never exposed to the public internet, eliminating risks like automated login-page scanning or unsolicited connection attempts. HTTPS is still provided through a Let's Encrypt certificate, obtained via a DNS-01 challenge that Tailscale handles internally without requiring public internet access. Key configuration details include persisting the Tailscale state directory to prevent node recreation on restart and tagging the device so its node key does not expire.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in