Chapter 20 Remote Access Without Exposing Everything: Tailscale and WireGuard

curl -fsSL https://tailscale.com/install.sh | sh
echo 'net.ipv4.ip_forward = 1' \
  | sudo tee /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
sudo tailscale up --advertise-routes=192.168.1.0/24
# Use your own LAN range -- the one Chapter 5's static IP sits in

Replaces that service's ports: lines.

# In a service's docker-compose.yml, bind only to the Tailscale IP
# instead of 0.0.0.0 or 127.0.0.1
ports:
  - '100.x.x.x:8080:8080'   # your server's Tailscale IP

# Find your Tailscale IP:
tailscale ip -4

services:
  wg-easy:
    image: ghcr.io/wg-easy/wg-easy:15.4.0
    container_name: wg-easy
    restart: unless-stopped
    environment:
      # web UI over plain http -- LAN only, never forward 51821
      - INSECURE=true
      - DISABLE_IPV6=true
    volumes:
      - ./etc-wireguard:/etc/wireguard
      - /lib/modules:/lib/modules:ro
    ports:
      - '51820:51820/udp'
      - '51821:51821/tcp'   # web UI, and its first-run setup wizard
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1