HTTPS using Tailscale

Tailscale VPN

HTTPS using Tailscale

Access Hrida.ai securely from anywhere on your private network. No ports, no certificates, no public exposure.

Mesh VPNWireGuard encryptedAuto TLS certsWorks behind NATTeam access

Tailscale creates an encrypted mesh VPN (a "tailnet") between your devices. Every device gets a stable hostname like my-server.tail1234.ts.net, and Tailscale can provision trusted HTTPS certificates for it automatically. Your Hrida.ai instance stays completely private, accessible only to devices on your tailnet.

When to use Tailscale

Tailscale is ideal when you want private, authenticated access across devices without exposing Hrida.ai to the public internet. Perfect for personal setups, small teams, or accessing a home server from your phone or laptop on the go.

ℹ️ Looking for the full guide?

This page covers HTTPS setup specifically. For the complete Tailscale integration story, including SSO authentication, Docker Compose sidecar setup, and more, see the Tailscale Integration Tutorial.

---

Prerequisites

Requirement	Details
Hrida.ai	Running locally on port 8080 (default)
Tailscale account	Free for personal use at tailscale.com
Tailscale installed	On both the server running Hrida.ai and any client devices

---

1Install Tailscale

macOS

Download from the Mac App Store or:

brew install tailscale

Linux

curl -fsSL https://tailscale.com/install.sh | sh

Windows

Download from tailscale.com/download.

2Connect the server

On the machine running Hrida.ai:

sudo tailscale up

Your machine gets a tailnet hostname like my-server.tail1234.ts.net. Find it with:

tailscale status

3Access Hrida.ai

From any device on the same tailnet, open:

http://my-server.tail1234.ts.net:8080

This connection is already encrypted end-to-end by WireGuard. For browser features that require HTTPS (like Voice Calls), continue to the next step.

---

Enable HTTPS with Tailscale certificates

Tailscale can provision trusted Let's Encrypt certificates for your tailnet hostname.

1Enable HTTPS in the admin console

Go to Tailscale Admin → DNS and enable HTTPS Certificates.

2Generate a certificate

sudo tailscale cert my-server.tail1234.ts.net

This creates two files in the current directory:

CRTmy-server.tail1234.ts.net.crtKEYmy-server.tail1234.ts.net.key

3Serve Hrida.ai over HTTPS

Use tailscale serve to proxy HTTPS traffic directly to Hrida.ai without any reverse proxy:

sudo tailscale serve https / http://localhost:8080

Now access Hrida.ai at:

https://my-server.tail1234.ts.net

No port number needed. Tailscale handles TLS termination and proxies to your local Hrida.ai.

---

Configure Hrida.ai

Set HRIDAAI_URL so OAuth callbacks and internal links resolve correctly:

docker run -d \
  -p 8080:8080 \
  -e HRIDAAI_URL=https://my-server.tail1234.ts.net \
  -v hrida-ai:/app/backend/data \
  --name hrida-ai \
  ghcr.io/hrida-ai/hrida-ai-studio:main

---

Tailscale Funnel (optional public access)

Optional — Public Access

If you want to share Hrida.ai publicly (without requiring Tailscale on the client), Tailscale Funnel exposes your tailscale serve endpoint to the internet:

sudo tailscale funnel https / http://localhost:8080

Your Hrida.ai is now publicly accessible at https://my-server.tail1234.ts.net with a valid TLS certificate. Funnel routes traffic through Tailscale's infrastructure, similar to Cloudflare Tunnel.

⚠️ Warning

Funnel makes your Hrida.ai accessible to anyone on the internet. Make sure you have authentication configured in Hrida.ai before enabling it.

---

Quick reference

What	Command / Value
Connect to tailnet	sudo tailscale up
Check hostname	tailscale status
Serve over HTTPS	sudo tailscale serve https / http://localhost:8080
Public access (Funnel)	sudo tailscale funnel https / http://localhost:8080
Generate cert manually	sudo tailscale cert my-server.tail1234.ts.net
Admin console	login.tailscale.com/admin
Set CORS origin	CORS_ALLOW_ORIGIN=https://my-server.tail1234.ts.net