Reaching your vault
How your devices reach the vault is your choice. Tailscale is the easiest path and the one the guides describe, but it is optional: your own network, another VPN, or headscale all work.
The installer asks how you want to reach the vault and sets it up either way. Nothing in Harbor depends on Tailscale; it is a convenience the project recommends, not a requirement.
| Path | What you get | What you take on |
|---|---|---|
| Your tailnet, with Tailscale | Reachable from anywhere your devices are, over HTTPS, with nothing listening on the box's own interfaces. | A Tailscale account; a third-party coordination server. |
| Your own network | The vault on a LAN address and port. No accounts, no third party. | HTTP unless you add a certificate; reachable by anything on that network. |
| A VPN or mesh you already run | The same as your own network, on the address the VPN gives the box. | Whatever the VPN already costs you. |
| headscale | Tailscale's client with a coordination server you host yourself. | Running headscale. |
Over your tailnet#
With Tailscale, the vault is reachable only from devices signed in to your tailnet, over HTTPS with a certificate Tailscale issues, and nothing at all listens on the machine's own network interfaces. There is no LAN address, no port, and no bind setting to get wrong. From a phone on the other side of the world it works the same as from the sofa.
If you want this path, install Tailscale on the host, not only inside the stack:
curl -fsSL https://tailscale.com/install.sh | sh
tailscale upOn the host, your way in survives a Harbor that will not start, which is exactly when you need to reach the box. Tailscale also updates on its own schedule instead of riding along with app releases. The installer detects it and offers to use it.
In the Tailscale admin console, turn on HTTPS Certificates under DNS. Without it the vault has no certificate to present.
If you would rather not install anything on the host, the stack ships a Tailscale container instead. It needs an auth key from the admin console, under Settings, Keys, which you pass to the installer as TS_AUTHKEY.
On your own network#
If you prefer everything to stay on your LAN with no third-party coordination server, skip Tailscale entirely. The vault publishes a port instead. Tell the installer, or set it directly:
| Variable | Meaning |
|---|---|
HARBOR_BIND | The address to listen on. Default 127.0.0.1, that machine only. Use the machine's LAN address, or 0.0.0.0 for every interface. |
HARBOR_WEB_PORT | The port. Default 3000. |
The default is loopback, so forgetting the setting makes the vault unreachable, never accidentally public.
Alternatives to Tailscale#
A VPN or mesh you already run. WireGuard, or a mesh network of your own choosing, gives the box an address only your devices can reach. To Harbor that is simply your own network: bind to that address with HARBOR_BIND and the vault is reachable through the VPN and nowhere else. Harbor does not need to know the VPN exists.
headscale. If you like the Tailscale client but not the hosted coordination server, headscale is an open-source server for it that you run yourself. The Tailscale path above works unchanged against it.
A reverse proxy. On your own network, a proxy such as Caddy or nginx in front of HARBOR_WEB_PORT adds HTTPS with a certificate you control. This is the way to get the padlock without any tailnet.
Changing your mind#
Any of these can be switched later. harbor config changes the setting; harbor start applies it. If you use Tailscale, its identity lives in the data directory and is included in backups, so a restored vault comes back at the same tailnet name.