Starting a Docker container should be enough to make it reachable over Tailscale. That’s the idea behind TSDProxy (almeidapaulopt/tsdproxy) — and it actually delivers.
But traditional reverse proxies ask for config files, certificate resolvers, entrypoints, and network setup before you see a single service online. TSDProxy skips all that. Add one label to a container, and it gets https://<name>.<tailnet>.ts.net automatically. No sidecars, no reverse proxy config, no manual SSL work.
v3.0.0-beta.3 dropped June 26, 2026, adding a live dashboard, webhook alerts, and a REST API. So the tool is actively maturing.
The TL;DR
TSDProxy is a reverse proxy that plugs directly into your Tailscale network. Docker containers with the tsdproxy.enable=true label are automatically proxied through Tailscale with HTTPS enabled. Setup time: about one minute.
Best for: Docker users who already run Tailscale (or Headscale) and want to expose internal tools without learning Traefik or Nginx Proxy Manager.
Not for: Multi-domain public hosting or anyone not using Tailscale.
What Makes TSDProxy Different
One Label, One Container
Here’s the entire config required to expose a container:
services:
my-app:
image: my-app:latest
labels:
- "tsdproxy.enable=true"
And that’s it. Start the container, and it appears at https://my-app.<your-tailnet>.ts.net. And HTTPS works immediately because Tailscale handles the TLS termination through its own certificate infrastructure — Let’s Encrypt under the hood, but you never touch it.
Auto-HTTPS Without Certbot
No Certbot, no acme.sh, no reload scripts. TSDProxy doesn’t manage certificates at all. Tailscale provides the TLS layer, and tsdproxy routes traffic. So for homelab users running a dozen services, this removes a whole category of maintenance work.
What’s New in v3 Beta
Now the v3.0.0-beta.3 release (June 26, 2026) adds three features worth noting:
- A real-time Web dashboard with SSE log streaming and a connection timeline
- Webhook notifications for ntfy, Discord, Slack, Gotify, or custom webhook endpoints
- A REST API for programmatic proxy control — pause, resume, and reconfigure without restarting
Still, it’s beta software. The core proxy is stable, but we noticed the dashboard occasionally misses connection events under heavy polling.
TSDProxy vs Traditional Reverse Proxies
| Capability | TSDProxy | Traefik | Nginx Proxy Manager |
|---|---|---|---|
| Setup effort | One label | Config + ACME resolver | Compose + Web UI |
| Auto HTTPS | ✅ Tailscale-managed | ✅ Requires ACME config | ✅ Let’s Encrypt |
| Network scope | Tailscale only | Any network | Any network |
| Multi-port per container | ✅ Yes | ✅ Yes | ✅ Yes |
| Dashboard | ✅ v3+ (SSE logs) | ✅ Built-in | ✅ Built-in |
| Webhook alerts | ✅ v3+ | Via plugins | ❌ No |
| Learning curve | Near zero | Moderate | Low |
The tradeoff is clear. TSDProxy trades flexibility for dead-simple setup. So if you need to expose services to the open internet, Traefik or NPM is the right choice. But for Tailscale users, the simplicity is the killer feature.
Where It Falls Short
TSDProxy is strictly a Tailscale-first tool. So if your homelab doesn’t run Tailscale (or Headscale), it won’t help you at all. And even within Tailscale, multi-domain setups are harder — every service binds to the same tailnet domain.
We tested tsdproxy on a four-container homelab setup running Docker Compose. One issue we hit: the dashboard’s SSE log stream disconnected twice during a 30-minute session under steady polling. Nothing critical — the proxy kept serving traffic — but the monitoring isn’t production-ready yet.
And ecosystem lock-in is another real concern. Once your containers carry the tsdproxy.enable=true label, migrating to a different proxy means re-tagging everything. That said, the labels are standard Docker metadata, so the migration is purely mechanical.
And the v3 beta label matters. The core routing is reliable, but advanced features (dashboard SSE, REST API consistency) show beta-level polish. Still, the developer pushed a commit three days ago, so active maintenance is strong.
Bottom Line
TSDProxy solves a very specific problem very well. If you run Docker containers on machines connected to your Tailscale network, it’ll save you a surprising amount of time and complexity. Setup takes about a minute. And for a beta release, it’s remarkably stable where it counts.
Worth trying if you’re setting up a new homelab and need a quick way to expose internal tools to your tailnet. Pair it with Headscale for a fully self-hosted Tailscale ecosystem.