How to set up Tailscale
· Updated 31 July 2026 · SparkBox team
Zero-config mesh VPN. This guide covers how to access it, log in for the first time, configure the basics, and where its data lives so you can back it up.
1. What is Tailscale?
Access all your SparkBox services from anywhere without port forwarding, dynamic DNS, or firewall rules. Tailscale creates a secure mesh network between your devices using WireGuard under the hood. Share access with family or friends by sharing nodes on your tailnet — but note that sharing a node shares every port on it, so set an access-control rule first if you want guests limited to specific apps (see Family Sharing).
2. Before you start
Two one-time setup steps in your Tailscale admin console before this works: (1) at https://login.tailscale.com/admin/settings/features enable 'HTTPS Certificates' (older consoles also show a separate 'Tailscale Serve' toggle — enable it too if you see it; current consoles only have HTTPS Certificates). (2) Generate an auth key at https://login.tailscale.com/admin/settings/keys (reusable, 90 days). Full walkthrough at https://tomsparkbox.com/docs.html#remote-access-tailscale
3. Settings you can change
You can set these when you enable the module, or later from Apps → Tailscale in the dashboard:
- Tailscale Auth Key — Paste your Tailscale auth key here (starts with 'tskey-auth-'). Get one at https://login.tailscale.com/admin/settings/keys — use a reusable key if you want the container to reconnect automatically after restarts. NOTE: also make sure 'HTTPS Certificates' is enabled at login.tailscale.com/admin/settings/features — otherwise the module installs but tailnet HTTPS silently won't work.
4. Where your data lives
Tailscale's config and persistent data are stored on the SparkBox host under:
/opt/sparkbox/modules/tailscale/config/Backups via the SparkBox dashboard's Backup tile include this directory by default, so a single restore brings Tailscale back to its current state on a fresh install.
5. Custom serve / Funnel setups
SparkBox re-applies its own serve configuration every time the Tailscale container starts, so anything you add by hand with the tailscale serve or tailscale funnel CLI gets reset on the next update or restart — the classic symptom is a Funnel that works all day and silently drops back to private overnight. To make custom entries permanent, declare them in /opt/sparkbox/state/tailscale/serve.user.json instead (SparkBox v1.6.211+); SparkBox merges that file into its generated config on every regeneration. (An older file at modules/tailscale/serve.user.json still works and is copied across for you — state/ is the folder that survives a core upgrade.) Full walkthrough with an example: Custom serve & Funnel in the docs.
Next steps
That's Tailscale live on SparkBox.
If something doesn't match what you see, post in d/sparkbox or hit us up on YouTube. Every SparkBox bug gets patched; every UX-stumble in this guide gets rewritten.
Questions, or did this not match your box?
Every guide here came from a real problem someone hit. If yours behaves differently, say so — that is how these get corrected, and how the fix gets prioritised.
We answer there rather than in a comment box, because that is where the people who have already solved it are.