Has anyone been able to get Tailscale Serve working on StartOS 0.4?

fbv000 · July 25, 2026, 12:38am

Has anyone successfully used Tailscale Serve on StartOS 0.4?

I’m testing the new Tailscale integration with Tailscale 1.98.9:1.

The node connects correctly, MagicDNS works, HTTPS certificates work and
https://startos..ts.net reaches Tailscale Serve, but Serve returns HTTP 502.

StartOS creates:

Tailscale Serve
→ http://localhost:20000
→ socat
→ 10.0.3.1:53632
→ StartOS UI

What’s strange is that from inside the Tailscale container both backend URLs work:

wget http://10.0.3.1:53632
→ HTTP 200

wget http://127.0.0.1:20000
→ HTTP 200

But accessing the same backend through Tailscale Serve returns 502.

Has anyone confirmed Tailscale Serve working on StartOS 0.4?

I’m wondering if this could be an interaction between the StartOS integration,
Tailscale 1.98.9 and userspace-networking mode rather than a normal Tailscale
configuration issue.

fbv000 · August 2, 2026, 1:40pm

hi anyone can provide some guidance?

gocards · August 7, 2026, 1:15am

Confirming the same on Tailscale 1.98.9:2 (so the newer package revision doesn’t fix it), StartOS 0.4.0.

Same symptom: node signs in fine, MagicDNS resolves, HTTPS certificates enabled, HTTPS serve on the StartOS UI returns 502. HTTP-mode serve on the StartOS UI stalls rather than 502ing. Restarting the Tailscale service doesn’t help.

One data point that may help isolate it: serving the Tailscale package’s own admin interface over HTTP works fine — that page loads normally over the tailnet. So Serve itself is functional; the failure is specific to proxying the StartOS UI through the socat hop.

Also worth noting for anyone searching: Tailscale doesn’t appear under System → Gateways at all, so there’s no gateway-level config to check.

fbv000 · August 7, 2026, 1:39pm

Thanks for confirming, maybe who prepared the community package can provide some guidance

fbv000 · August 13, 2026, 1:31pm

Anyone using it that can provide some guidance?

carlos · August 21, 2026, 11:20pm

github.com/sudocarlos/tailscale-startos

Tailscale Serve returns HTTP 502 when proxying StartOS UI (HTTPS mode)

opened 07:47PM - 17 Aug 26 UTC

btc-saving-goals

## Summary … Tailscale Serve returns HTTP 502 when serving the StartOS UI over HTTPS. HTTP mode stalls indefinitely. Serving the Tailscale package's own admin interface works fine, isolating the problem to the proxy hop to the StartOS backend — not the tunnel itself. ## Environment - **StartOS:** 0.4.0 - **Tailscale package:** 1.98.9:2 - **Hardware:** System76 Meerkat (Intel i5, 32GB RAM) - **Network:** Cox residential gateway, not behind CGNAT ## Steps to reproduce 1. Install Tailscale package, sign into tailnet — node shows connected, health checks green. 2. Enable HTTPS Certificates in the Tailscale admin console (login.tailscale.com → DNS). 3. On the **StartOS UI** interface listing, click "Serve On Tailscale" (not the Tailscale package's own interface). 4. From a remote device on the tailnet, navigate to `https://startos.<tailnet>.ts.net`. ## Expected behavior StartOS UI loads normally over the tailnet. ## Actual behavior | Serve mode | Result | |---|---| | HTTPS (with HTTPS Certificates enabled) | **HTTP 502** | | HTTP | Page stalls indefinitely, no response | | Raw tailnet IP (HTTP and HTTPS) | Connection hangs, times out | | Tailscale admin UI served over HTTP | **Works fine** | Restarting the Tailscale service does not resolve the issue. ## Diagnostic details - The routing chain is: `Tailscale Serve → http://localhost:20000 → socat → 10.0.3.1:53632 → StartOS UI` - The backend responds HTTP 200 when curled from inside the Tailscale container, confirming the StartOS UI is up and reachable internally. - Serving the Tailscale package's own admin interface (by clicking "Serve On Tailscale" on the Tailscale interface listing) works correctly — this confirms the tunnel, TLS termination, and Serve mechanism are all functional. - The failure is specific to the socat proxy hop to the StartOS UI backend. ## Diagnostic progression - **Silent TCP hang** (before enabling HTTPS Certificates) → Serve not actually up; HTTPS Certificates are a prerequisite. - **HTTP 502** (after enabling HTTPS Certificates) → tunnel is up, TLS completes, Serve is answering, but the internal proxy to StartOS fails. This is the meaningful failure state. ## Suspected cause Possible interaction between the StartOS container networking, the socat bridge, and Tailscale's userspace-networking mode. The fact that the Tailscale admin UI proxies correctly while the StartOS UI does not suggests something specific to how the StartOS UI backend address/port is being proxied. ## Related discussion - Community thread: https://community.start9.com/t/has-anyone-been-able-to-get -tailscale-serve-working-on-startos-0-4/5395

Someone pointed to this thread in an issue for my package. I’m not sure if you’re actually using my package or one released by StartOS. My package is not the one in the Community Registry. The StartOS team is pretty busy applying fixes to stuff since releasing v0.4.0, meanwhile I am just trying to get the most-used features into this package for StartOS. To that end, I am up-to-date with the latest release: v1.102.3 and have implemented Headscale (custom control server) support. Check out my package. I haven’t had any issues with it including what’s been described here.

fbv000 · August 22, 2026, 2:42pm

Thanks for clarifying. I’m actually using the version packaged in the Community Registry, which is currently v1.98.92, so I’m not using your package yet.

I came across your package while looking for a newer version because the Community Registry version isn’t working properly for me. Good to know yours is already on v1.102.3 and that you’ve added Headscale support.

Do you know who actually maintains/packages the Tailscale version in the StartOS Community Registry? Is that done by the StartOS team, someone in the community, or Tailscale itself?

carlos · August 22, 2026, 4:15pm

This is the package in the Community Registry and it’s maintained by StartOS.