Skip to main content

Configuration

Configure the Tailscale app from Home Assistant's Configuration tab. Restart the app after changing an option.

Defaults​

accept_dns: true
accept_routes: false
advertise_connector: false
advertise_exit_node: false
advertise_routes: []
advertise_tags: []
always_use_derp: false
log_level: info
log_upload: false
login_server: "https://controlplane.tailscale.com"
share_homeassistant: disabled
share_on_port: 443
services: []
snat_subnet_routes: true
stateful_filtering: false
taildrive:
  local_apps: false
  app_configs: false
  backup: false
  config: false
  media: false
  share: false
  ssl: false
taildrop: false
userspace_networking: false

DNS and routes​

  • accept_dns: accept DNS settings configured for your tailnet. Enabled by default.
  • accept_routes: use subnet routes advertised by other Tailscale devices. Disabled by default.
  • advertise_routes: advertise local networks using CIDR notation, such as 192.168.1.0/24. The special value local_subnets detects supported local subnets.

Advertised routes must also be approved on the Tailscale admin console's Machines page.

Access and networking​

  • advertise_exit_node: advertise Home Assistant as an exit node. Enable it in the Tailscale admin console too.
  • exit_node: route traffic through another Tailscale exit node. Do not use this with advertise_exit_node.
  • advertise_connector: advertise Home Assistant as an app connector.
  • userspace_networking: avoid creating a tailscale0 interface. Disabled by default.
  • snat_subnet_routes: source-NAT subnet-routed traffic. Enabled by default.
  • stateful_filtering: restrict forwarded traffic to connections with an existing outbound flow. Disabled by default.

Home Assistant sharing​

share_homeassistant supports disabled, serve, and funnel:

  • serve exposes Home Assistant over HTTPS to devices on your tailnet.
  • funnel exposes Home Assistant publicly through Tailscale Funnel.

For Serve or Funnel, configure Home Assistant to trust the local reverse proxy, then enable MagicDNS and HTTPS certificates in Tailscale. Use Funnel only when public access is intentional.

share_on_port controls the port and accepts 443, 8443, or 10000.

Tailscale Services​

Expose local applications as Tailscale Services with services:

advertise_tags:
  - tag:homeassistant
services:
  - name: svc:audiobookshelf
    target: http://127.0.0.1:13378
    protocol: http
    port: 80
    path: /

Service names require the svc: prefix. The device must use a Tailscale tag, and the service must be defined and approved in the Tailscale admin console.

File sharing​

Enable taildrop to receive files in /share/taildrop. Use taildrive to select Home Assistant directories for sharing; all directories are disabled by default.

Logging and control server​

  • log_level: trace, debug, info, notice, warning, error, or fatal. Use info for normal operation.
  • log_upload: allow Tailscale client logs to be uploaded when required by your tailnet policy.
  • login_server: use the default control server or a compatible custom server such as Headscale.

Consider disabling Tailscale key expiry for this device if an expired key would interrupt access to Home Assistant. Use tailscale ping <hostname-or-ip> when troubleshooting peer connectivity.