services:
  tailscale:
    image: tailscale/tailscale:latest
    container_name: tailscale
    restart: unless-stopped
    hostname: ${TS_HOSTNAME:-homelab}
    network_mode: host
    environment:
      # Generate at https://login.tailscale.com/admin/settings/keys
      - TS_AUTHKEY=${TS_AUTHKEY:-}
      - TS_STATE_DIR=/var/lib/tailscale
      # Advertise your LAN so tailnet clients can reach it, e.g. 192.168.1.0/24
      - TS_ROUTES=${TS_ROUTES:-}
      - TS_EXTRA_ARGS=${TS_EXTRA_ARGS:---accept-dns=false}
    volumes:
      - ${DATA_PATH:-/srv/tailscale}:/var/lib/tailscale
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - NET_ADMIN
      - NET_RAW