If you are looking to run a Tailscale service in your FNOS NAS, here is a docker-compose file might help you:
services:
tailscale:
# Official Tailscale Docker image.
image: tailscale/tailscale:latest
# Docker container name. This is only used by Docker.
container_name: tailscale
# Hostname inside the container.
# This may be used as a reference name, but TS_HOSTNAME below is more explicit for Tailscale.
hostname: tailscale-docker
# Use the host network stack.
# This is recommended when using Tailscale as an exit node or when you want the host itself
# to be reachable through Tailscale.
network_mode: host
# Required network capabilities for kernel-mode Tailscale networking.
# NET_ADMIN allows Tailscale to configure routes, interfaces, and firewall rules.
# NET_RAW allows low-level network packet handling.
cap_add:
- NET_ADMIN
- NET_RAW
environment:
# Tailscale auth key.
# Replace this with your own key.
# Do NOT share your real auth key publicly.
- TS_AUTHKEY=YOUR_TAILSCALE_AUTH_KEY_HERE
# Directory where Tailscale stores its state.
# This keeps the node identity persistent across container restarts.
- TS_STATE_DIR=/var/lib/tailscale
# Disable userspace networking and use kernel networking instead.
# This requires /dev/net/tun and the network capabilities above.
# Recommended for exit node usage.
- TS_USERSPACE=false
# Authenticate only once when the state directory already contains valid Tailscale state.
# This prevents the container from re-authenticating on every restart.
- TS_AUTH_ONCE=true
# Advertise this NAS/server as a Tailscale exit node.
# --netfilter-mode=on allows Tailscale to manage firewall/NAT rules automatically.
# This is important for routing client internet traffic through this machine.
- TS_EXTRA_ARGS=--advertise-exit-node --netfilter-mode=on
# Display name shown in the Tailscale admin console and clients.
# Change this to a name that helps you identify the device.
- TS_HOSTNAME=my-nas-exit-node
# Let Tailscale automatically select the correct Linux firewall backend.
# Useful on systems using nftables instead of legacy iptables.
- TS_DEBUG_FIREWALL_MODE=auto
volumes:
# Persist Tailscale state on the host.
# Replace the left side with your own host directory.
# Example: /vol1/1000/docker/tailscale:/var/lib/tailscale
- /path/to/tailscale/state:/var/lib/tailscale
devices:
# Expose the host TUN device to the container.
# Required for kernel-mode VPN networking.
- /dev/net/tun:/dev/net/tun
# Restart the container automatically unless it was manually stopped.
# This makes Tailscale start again after NAS/server reboot.
restart: unless-stopped
