Tailscale provider

A non-routing provider: it doesn't generate routers or services, it provides certificates. When a router references a tailscale certificate resolver, this provider obtains the certificate from the local Tailscale daemon.

Source

pkg/provider/tailscale/:

• provider.go — connects to the Tailscale local API and serves certificates.
• certificate.go — certificate retrieval and refresh.

Configuration

certificatesResolvers:
  tailscale:
    tailscale: {}

http:
  routers:
    api:
      rule: Host(`api.tailnet.ts.net`)
      service: api
      tls:
        certResolver: tailscale

No fields are required under tailscale: {} — the provider talks to the local daemon by default.

How it works

graph LR
    Static[static config<br/>certificatesResolvers] --> Provider[provider.go: Provide]
    Provider --> Local[Tailscale local API<br/>tailscale-d socket]
    Local --> Cert[certificate]
    Cert --> Watcher[configuration watcher]
    Watcher --> TLSManager[pkg/tls/tlsmanager.go]

The provider asks the Tailscale daemon for the certificate matching the hostname. The daemon issues or fetches it via Tailscale's own ACME plumbing, signed by Tailscale's CA. The certificate is then handed to the configuration watcher just like any other dynamic certificate.

Tailscale handles renewal — Traefik just polls periodically and updates the certificate when a new one is available.

Why use it?

For services that live on a Tailscale network (*.your-tailnet.ts.net), the Tailscale resolver is simpler than ACME:

• No ports 80/443 reachable from the public internet.
• No DNS-01 challenge plumbing.
• Certificates rotated by Tailscale, transparent to Traefik.

It complements rather than replaces ACME. If you need certificates for public hostnames, use ACME.

Tests

• pkg/provider/tailscale/certificate_test.go covers the certificate lifecycle.

Practical notes

• The Traefik process must run on a host joined to the tailnet, with the Tailscale daemon running and reachable via its local API socket.
• Certificate-refresh frequency is controlled by Tailscale's own settings; the provider simply consumes them.