tsnet-proxy

Overview ¶

The tsnet-proxy command exposes a local port on the tailnet under a chosen hostname. By default it proxies raw TCP; pass --http to reverse proxy as HTTP, or --https to reverse proxy as HTTPS with an auto-issued Tailscale cert. Both HTTP modes inject Tailscale-User-* identity headers from WhoIs.

Arguments are <name> <local> [tailnet]: local is the port on localhost to proxy to and tailnet is the port to expose on the tailnet. If tailnet is omitted, it defaults to 443 for --https, 80 for --http, and the local port otherwise.

go run ./cmd/tsnet-proxy myapp 8080           # raw TCP, tailnet :8080
go run ./cmd/tsnet-proxy myapp 22 2222        # raw TCP, tailnet :2222
go run ./cmd/tsnet-proxy --http myapp 8080    # tailnet :80
go run ./cmd/tsnet-proxy --https myapp 8080   # tailnet :443

Or run directly from the module, no checkout required:

go run tailscale.com/cmd/tsnet-proxy@latest myapp 8080