Single service tailscale node with docker compose

service-as-tailscale-node-docker-compose.yaml

version: "3.8"
services:
  # all services share a networking namespace
  tailscale:
    restart: always
    # machine name
    hostname: passwords
    cap_add:
      - net_admin
    image: tailscale/tailscale:latest
    secrets:
      - authkey
    environment:
      - TS_AUTHKEY=file:/run/secrets/authkey
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_SOCKET=/var/run/tailscale/tailscaled.sock
      - TS_USERSPACE=false
    volumes:
      - tailscale_data:/var/lib
      - /dev/net/tun:/dev/net/tun
      - tailscale_run:/var/run/tailscale
    healthcheck:
      test: ["CMD", "tailscale", "status"]
  # handles proxying traffic to the machine on port 443 to the backend
  serve:
    restart: on-failure
    depends_on:
      tailscale:
        condition: service_healthy
      backend:
        condition: service_healthy
    network_mode: "service:tailscale"
    image: tailscale/tailscale:latest
    command: tailscale serve https / http://localhost:80
    volumes:
      - tailscale_run:/var/run/tailscale
  backend:
    restart: always
    network_mode: "service:tailscale"
    image: vaultwarden/server:latest
    volumes:
      - /data/vaultwarden/:/data

volumes:
  # share the tailscaled socket at /tmp
  tailscale_run:
  # persist the node data
  tailscale_data:

secrets:
  authkey:
    file: ./tsauthkey