Self-host tsbridge
v0.15.1Tailscale reverse proxy for multiple services
- Stars
- 317
- Port
- 443 (HTTPS (TLS mode auto))
- Requires
- Tailscale
ghcr.io/jtdowney/tsbridgeWhat is tsbridge?
tsbridge is a lightweight reverse proxy manager that uses Tailscale's tsnet library to expose multiple backend services on a Tailnet. It eliminates the need to run a separate tsnet sidecar for each service by managing multiple services from a single process. Configuration is done via a TOML file or automatically through Docker container labels, similar to Traefik. It supports OAuth authentication with Tailscale, Headscale compatibility, Prometheus metrics, trusted identity headers via Whois, Tailscale Funnel for public exposure, and streaming/SSE with configurable timeouts. The project targets homelabs and development environments and is not hardened for production workloads. It can be installed via pre-built binaries, Go install, or Docker images from ghcr.io.
tsbridge alternatives
TraefikTraefik is a self-hosted, open-source reverse proxy that auto-discovers services from Docker, Kubernetes, and other orchestrators to route traffic without manual config.CompareTraefik with tsbridge
tlsproxySelf-hosted TLS termination proxy with auto Let's Encrypt, SSO (OIDC/SAML/Passkeys), and reverse proxy for multiple services on one port.Comparetlsproxy with tsbridge
Traefik-Koptraefik-kop is an open-source agent that reads Docker labels and publishes them to Redis for Traefik, enabling multi-host routing without Swarm or Kubernetes.CompareTraefik-Kop with tsbridge
Traefik ManagerSelf-hosted web UI for managing Traefik reverse proxy — create routes, services, middlewares, certificates, and monitor logs and CrowdSec without editing YAML by hand.CompareTraefik Manager with tsbridge
Self-Hosted GatewayOpen-source alternative to Cloudflare Tunnels using WireGuard, NGINX, and Caddy to expose local Docker containers without port forwarding.CompareSelf-Hosted Gateway with tsbridge
Middleware ManagerA self-hosted web UI for managing Traefik middlewares, custom services, plugins, and mTLS — compatible with Pangolin or Traefik directly.CompareMiddleware Manager with tsbridge
TailGuardSelf-hosted Docker container that bridges WireGuard-only devices into a Tailscale network, advertising WG subnets to the tailnet with an optional monitoring web UI.CompareTailGuard with tsbridge
usulnetSelf-hosted Docker management platform with built-in OSINT recon, metadata hygiene, and infrastructure tooling — all in a single AGPL-3.0 binary.Compareusulnet with tsbridge
Should you self-host tsbridge?
tsbridge scores 48/100 on selfhost.directory (how scoring works) and ranks #19 of 31 in Networking. It has 317 GitHub stars.
It shipped 7 stable releases in the past year. The latest, v0.15.1, came out on 21 August 2026. New versions land roughly every 6 weeks.
Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is MIT-licensed and written mostly in Go.
Its closest alternative on selfhost.directory is headscale (82/100, 45 190 stars). It scores higher overall, so compare the two before you pick. See tsbridge vs headscale side by side.
Features
- Docker label discovery
- Ephemeral Nodes
- Header manipulation
- Headscale supportTLS must be disabled until Headscale issue #2137 is implemented
- HTTPS backend support
- Multi-service reverse proxy
- Per-service configuration overrides
- Prometheus Metrics
- Streaming/SSE support
- Tag ownership security model
- TOML Configuration
- Unix socket backends
- Whois identity headers
tsbridge README
tsbridge acts as a tsnet-powered reverse proxy, letting you expose multiple backend services on your Tailnet from a single process. It's designed for homelabs and development environments where you want the magic of Tailscale without the hassle of running a separate sidecar for every service.
More in Homelab
unifi-gatewaySelf-hosted Python daemon emulating a Ubiquiti UGW3 gateway so non-Ubiquiti routers appear in UniFi Controller with full network topology.
unraid-config-guardianSelf-hosted open-source tool that backs up Unraid containers, settings, and plugins — generating templates, compose files, and a restore script for flash drive recovery.
WatchYourLANSelf-hosted, open-source LAN IP scanner in Go: inventories devices via arp-scan, tracks online/offline history, alerts on new hosts; exports to InfluxDB2 or Prometheus.
WebSSHSelf-hosted SSH/SFTP browser workspace with multi-user terminals, split panes, file transfers, and optional Passkeys/OIDC/LDAP. Deploy via Docker on your infrastructure.
yantrYantr is a self-hosted homelab app store running as a rootless Podman container alongside your Linux OS — no appliance, no root daemon, ~140 MB RAM at idle.
ZoraxyOpen-source reverse proxy manager for self-hosted services, with a web UI, ACME TLS, TCP/UDP forwarding, an uptime monitor and a built-in SSH terminal.
Ansible-NASSelf-hosted Ansible playbook for building homelabs or NAS replacements on Ubuntu Server 22.04 LTS. Installs over 50 preconfigured applications using Docker.
atlasOpen-source, self-hosted network scanner that discovers Docker containers and subnet hosts, then maps them in an interactive React dashboard.
beaconSelf-hosted agent for remote tunnels, browser terminal, and health monitoring on every machine — Pi, NAS, VPS, Proxmox — zero open ports, no cloud root.
BeszelOpen-source, self-hosted server monitoring: a hub plus per-host agents tracking CPU, memory, disks, containers, GPU and temperatures, with alerts and historical data.
CoreObsCoreControl is a self-hosted, open-source dashboard for homelab servers: track hardware info, quick links to self-hosted apps, uptime checks and network flowcharts.
CupSelf-hosted, open-source tool for checking Docker image updates, with a CLI, a web server dashboard, JSON output and support for registries like Docker Hub and ghcr.io.
0 comments