tailhome

The start page that builds itself from your tailnet, plus live HTTPS previews from your coding agents.

Stop editing YAML every time you spin up a container or start a dev server. Run tailhome once to get http://home/ on every Tailscale device: your NAS, homelab and team apps appear automatically with icons and live health checks, and your coding agents can publish side-by-side branch previews (A, B, C) straight to your phone.

tailhome (the start page) and tailnet-preview (the coding-agent skill) work alone or together:

What you want	What to install
Auto-discovered start page for your NAS, homelab or team	Run tailhome (1 container, no agent required)
Private phone links from Claude Code, Codex, Gemini CLI or omp	Install tailnet-preview (1 command, no tailhome server required)
Apps and live agent previews in one place	Install both and enable preview ports

Quick start

1. Enable MagicDNS and HTTPS Certificates in your Tailscale DNS settings, then start tailhome on any machine running Docker:

   docker run -d --name tailhome --restart unless-stopped \
     -v tailhome-data:/data ghcr.io/mickey/tailhome:latest
   docker logs -f tailhome

   Open the login link printed in the logs to join your tailnet.

2. When the logs show serving https://home.<tailnet>.ts.net, open http://home/ (with the trailing slash) from any device on your tailnet. If home was already taken, use the hostname shown in the logs.

3. Publish your first app. On any machine with Tailscale installed, expose a local port to your tailnet:

   tailscale serve --bg --https=443 8080

   On Linux, run with sudo or grant operator access once with sudo tailscale set --operator=$USER. Click refresh on http://home/ and your app tile appears.

Teammates and family only need Tailscale and access in your tailnet policy. See Setup for Docker Compose, prebuilt binaries, systemd, OAuth (svc:home) and unattended auth keys.

Why tailhome

• Auto-discovered catalog and health checks. Finds Tailscale Services and HTTPS device apps on your tailnet, matches dashboard-icons, and probes health over Tailscale.
• No exposed ports, Docker socket or reverse proxy. Joins your tailnet in userspace via tsnet inside a static, non-root container; the Docker host does not even need Tailscale installed.
• Live previews from coding agents. Ask "Can I see these three versions on my phone?" Your agent publishes private HTTPS previews over Tailscale Serve, attaches A/B/C comparison cards, and cleans up its mappings when done.
• Built for phones and keyboards. Install http://home/ as a mobile web app, jump to any app from the address bar with home/go/jellyfin, or copy SSH/Postgres addresses in one click.
• Public links when you need them. Admins can share an app on the internet for a set time and stop it at any time.
• Eight color palettes in light and dark. Switch between Default, Catppuccin, Gruvbox, Tokyo Night, Rosé Pine, Solarized, Kanagawa and One.

When to use something else: tailhome only lists what lives on your tailnet. For CPU graphs, weather widgets or external bookmarks, use Homepage, Glance, Homarr or Dashy, and optionally feed them your tailnet app list via /api/list.json.

Previews from coding agents

Compare branches on your phone or review a UI running on a remote devbox without port forwarding, public tunnels, or staging deploys.

Tip

Paste this into Claude Code, Codex, Gemini CLI, OpenCode or omp:

Install the tailnet-preview skill (npx skills add mickey/tailhome --skill tailnet-preview -g), then show me this app on my phone.

Or install the skill yourself (requires Node 22.20+ for the installer; the skill itself uses Python 3.9+ and the Tailscale CLI on Linux or macOS):

npx skills add mickey/tailhome --skill tailnet-preview -g

Restart your agent so it loads the skill, then ask:

• "Can I see this on my phone?"
• "Publish three versions of the new pricing hero so I can compare them."
• "Remove the landing previews."

On first run, the agent checks your Tailscale setup and asks which HTTPS ports it may use (such as 8443-8452), leaving existing mappings untouched. Each preview gets a private https://<machine>.<tailnet>.ts.net:<port>/ link and a /.well-known/tailhome.json card so http://home/ groups versions side by side with A, B, C badges.

Previews are private to your tailnet and stay live while your machine is awake and the dev server is running. See the skill guide for Claude Code, omp and Gemini CLI plugin commands, an AGENTS.md / CLAUDE.md snippet to make previews automatic, and preview discovery setup.

Share an app publicly

Need to show an app or an agent preview to someone outside your tailnet? Click the globe on its tile. tailhome gives it a public HTTPS address through Tailscale Funnel for 1 hour, 8 hours, 24 hours, 7 days or until you stop it. Previews are limited to 24 hours and stop sharing when they are removed or change. Stopping closes public access at once.

Set TAILHOME_SHARE_ADMINS to enable sharing for the admins you name. It needs an OAuth client that can create auth keys and a few lines in your tailnet policy. See public sharing.

What appears on home/

Source	How it works
Tailscale Services	Discovered automatically from the local netmap. Add a read-only OAuth client to list every Service on the tailnet with tags as groups and descriptions on tiles. Non-web Services (SSH, Postgres, Redis) appear under Other with one-click copy.
Device apps	Any tailnet device serving HTTPS on port 443 with a valid certificate appears as a tile with live health status. Container publishers like DockTail, TSDProxy, tsbridge and ScaleTail work out of the box.
Agent & dev previews	Any app on TAILHOME_PREVIEW_PORTS (or on port 443 with a preview: true card) appears at the top under Previews while its server responds, and disappears cleanly when stopped.

Need custom names, groups, icons or ordering? Drop an optional config/overrides.yaml next to your config.

Documentation

Guide	Covers
Setup and configuration	Docker Compose, binaries, systemd, OAuth (svc:home), public sharing via Funnel, preview ports and environment variables
Apps, previews and page controls	How Services, devices and preview cards (/.well-known/tailhome.json) are discovered, health indicators and container publishers
Customization and JSON API	overrides.yaml reference, /go/<name> shortcuts, /api/list.json and /api/services.json
Integrations	Ready-to-paste widgets for Homepage and Glance, plus DockTail container labels
tailnet-preview skill	Agent installation, plugins, automatic AGENTS.md rules, with troubleshooting in the reference
Troubleshooting	Fixes for DNS, certificates, OAuth, missing tiles and Serve permissions

Security and privacy

tailhome has no login of its own and no analytics or telemetry. Your Tailscale access policy controls who can open home/ and each individual app.

Everyone who can open tailhome sees the same catalog (app and preview names, descriptions, addresses and up/down status) on the page and JSON endpoints, even for apps their own Tailscale policy blocks them from opening. Hiding a tile in overrides.yaml removes it from the page, not from the network.

Device discovery probes reachable devices on your tailnet, including other members' laptops (TAILHOME_DEVICES=off disables this). Listing Services with tags and descriptions only needs OAuth Services: Read; add Auth Keys: Write only for unattended enrollment or opt-in public sharing.

Browsers share cookies across all ports on the same hostname, including HttpOnly cookies. Only publish trusted code on machines where you stay signed in to other apps. Logs can contain the initial login link: open it yourself and do not share it.

See Security and network requests for icon CDN privacy and Tailscale diagnostic logs, and SECURITY.md to report vulnerabilities.

Status

Actively maintained; pre-1.0 releases (v0.x) ship container images (linux/amd64, linux/arm64, linux/arm/v7) and static binaries for Linux, macOS and Windows.

Is it any good?

Yes.

---

Tailscale is a trademark of Tailscale Inc. tailhome is not affiliated with or endorsed by Tailscale.