Deploy Apps Privately with Tailscale

What you need

• A Wodby account and a Kubernetes cluster using app routing.
• A Wodby app with at least one enabled external HTTP endpoint.
• A Tailscale account and access to its admin console.
• Permission to create tags and OAuth credentials and to enable tailnet DNS features.
• The Tailscale client installed and connected on every device that should reach the private app.

1. Prepare the tailnet

1. In the Tailscale admin console, open Access Control → Tags and create a tag named wodby.
2. Open DNS and enable both MagicDNS and HTTPS Certificates.
3. Copy the Tailnet DNS name shown on the DNS page. Wodby uses this suffix when it assigns endpoint hostnames.
4. Review the tailnet's access controls. Users and devices that need the app must be allowed to reach devices carrying the tag:wodby tag over HTTPS. Wodby does not create or change these rules.

2. Create scoped OAuth credentials

1. Open Settings → Trust credentials in the Tailscale admin console and create OAuth credentials.
2. Use a recognizable description such as wodby.
3. Grant Write access to both Auth Keys and Devices.
4. Restrict the credentials to tag:wodby and copy the generated Client ID and Client Secret.

The OAuth credentials let Wodby create short-lived connector credentials and retire the devices it owns. The tag restriction prevents those credentials from creating unrelated untagged devices in the tailnet.

3. Create the Wodby integration

1. Open Integrations in the Wodby dashboard and select New integration.
2. Choose Tailscale, then select the Application Access type.
3. Enter the OAuth Client ID and Client Secret.
4. Enter the Tailnet DNS name copied from the Tailscale DNS page and create the integration.

4. Enable Tailscale access for the app

For a new app, configure Access in Step 4, App settings. For an existing app instance, open Settings → Access. Then choose:

1. Set the Wodby Access mode to Protected. This is the top-level choice meaning the ordinary public route will not be used.
2. Select the Tailscale Application Access integration.
3. Choose Entire app or Selected endpoints.

Tailscale provides the Private network access type automatically. There is no DNS-zone, policy, or primary-hostname input in Wodby because the tailnet supplies DNS and access control.

5. Deploy and verify access

Wodby suppresses the selected public routes before the first deployment and waits for the workload to become ready. It then creates scoped auth keys, joins its endpoint connectors to the tailnet as tagged devices, and assigns stable HTTPS hostnames.

1. Wait for the app deployment and Application Access task to complete successfully.
2. Connect your device to the same tailnet and confirm Tailscale is active.
3. Open the Tailscale-marked *.ts.net effective URL shown by Wodby in the app header or route list.
4. Disconnect Tailscale and confirm the private address can no longer reach the app.

Wodby derives each hostname from the app, app instance, service or port, and Tailnet DNS name. Routes and aliases that target the same HTTP port share one Tailscale endpoint hostname.

Troubleshooting

• The hostname does not resolve: confirm MagicDNS is enabled, the integration has the correct Tailnet DNS name, and your device is connected to that tailnet.
• HTTPS does not work: confirm HTTPS Certificates are enabled on the Tailscale DNS page and wait for the Access task to finish.
• The connection is denied: review tailnet grants or ACLs and confirm the user or device can reach tag:wodby over HTTPS.
• Integration validation fails: confirm the OAuth credentials have Write access to Auth Keys and Devices and are scoped to the existing wodby tag.
• Access shows an error: open the Access task from the app state indicator and review the provider or connector step that failed.

Changing or removing access

Update the scope or selected endpoints from Settings → Access. To move the app to another Application Access provider, remove Access and enable it again with the replacement integration after cleanup completes.

Removing Access restores the matching ordinary public routes and removes Wodby-managed endpoint devices, auth keys, connector secrets, and cluster resources. Wodby does not remove the wodby tag, MagicDNS or HTTPS settings, tailnet access rules, or unrelated Tailscale devices.

For the product overview, see Application Access. For the complete provider contract and cleanup behavior, see the Tailscale provider documentation and Application Access documentation.