Connect an app to Tailscale or Headscale

Use the app’s Private network section where supported. Tailscale is the hosted service; Headscale is a self-hosted network controller used with Tailscale clients.

Connect and test

1. Select Tailscale or My Headscale server.
2. For Headscale, enter the server’s valid public HTTPS URL as requested by the panel.
3. Choose a private hostname and the offered access mode.
4. Connect, open the approval link and approve/register the app’s device.
5. Connect your own device to the same network and test the assigned private URL.

Enable MagicDNS as required. Tailscale HTTPS also requires its DNS/HTTPS setup. Headscale mode uses HTTP inside the encrypted private network; apps requiring HTTPS cookies or secure browser features may not work at that address.

Make the app private

For an existing public app, the panel lets you connect and test before explicitly selecting Make app private. Private-only mode blocks public URLs and callbacks and can briefly restart the app.

Public webhooks cannot reach a private-only app. Public SFTP may also be disabled; use the supported private connection for file access.

Disconnect or change provider

Read the warning first: disconnecting restores public access. Do not use disconnect as a troubleshooting shortcut if the app must remain private. Provider changes require the displayed disconnect/reconnect workflow. Follow any region-move restriction shown in the panel.