Hey everyone,

I’m a huge fan of Tailscale for mesh networking and I love the way Control D handles dynamic DNS routing. But I always wished I had a simple, self-hosted way to combine their power: running multiple VPN tunnels side-by-side, using them as Tailscale Exit Nodes / App Connectors, and managing a custom DNS Control Plane for my Tailnet.

Setting up isolated exit nodes with custom outbound VPNs (WireGuard, NordVPN) or split tunneling manually usually requires wrestling with network namespaces, iptables/nftables, and complex DNS configs.

So I built Hermit to make this instant — packaged entirely inside a single Docker container with zero external database dependencies:

⚡ What it does:

• Single Docker Container Setup: Everything (web UI, DNS engine, netns orchestrator, SQLite) is packaged inside one single container. No complex multi-container stacks required.
• Multiple Tunnels & Exit Nodes: Spin up multiple independent connection pairs side-by-side in isolated Linux network namespaces (netns) without route leaks or host network conflicts.
• Domain-based Split Tunneling (Tailscale App Connector): Easily configure domain-based split tunneling via Tailscale App Connectors. Simply input your target domains in the UI, and traffic for those domains is automatically routed through your specific tunnel across the entire Tailnet.
• Tailscale Integration & Outbound Routing: Pair any Tailscale node with outbound profiles (WireGuard, NordVPN, or Local interface).
• Control D-inspired DNS Control Plane:
  • Automatically provisions Tailscale DNS Nodes on your tailnet with built-in blocklists (AdGuard, GoodbyeAds) and custom domain routing rules (Block, Bypass, Redirect, Forward).
  • Auto-sets the DNS node as your tailnet-wide nameserver with one click.
  • Generates secure DoH endpoints and Apple .mobileconfig profiles for iOS/macOS.

🔗 Code & Repo

• GitHub: https://github.com/quaywin/hermit

I’d love to hear your thoughts, feedback, or ideas for new features. Thanks for checking it out!

I run Plex (lifetime pass) on our home server (via Unraid) and want to start sharing my library with a few friends and family members. From what I've read in the past, Tailscale is widely considered the most secure way to share Plex access remotely, etc. However, the thing I can't wrap my head around is that I'm pretty sure most of the people I would want to share with wouldn't necessarily be accessing the library on their computers but instead on living room streaming boxes like Rokus, Apple TVs, etc. Is Tailscale/Plex in any way compatible with those types of devices? If yes, is it straightfoward enough that I could document and/or explain it to them effectively (think, your parents trying to navigate this)? Appreciate any and all feedback as I consider how best to go about this. Thank you!

Hi y'all,

I'm not particularly adept at server/networking stuff so my apologies if I'm using terms incorrectly. Last night I was able to get tailscale running inside a docker container on my home hobby server and it's running as a funnel and I can access it on the open internet from a domain similar to this "https://subdomain2.subdomain.ts.net/home" however I'm struggling to figure out what DNS records I need to put in at my registrar to adequately get subdomain.mywebsite.com to point at the application running in the docker container that is accessable at https://subdomain2.subdomain.ts.net/home

I've currently got an A record pointed at the IPV4 address but that page in the website subdomain just never fully loading as if its just stuck waiting on a server response.

I'm not sure if there's some setting in Tailscale I need to change or command I need to run to allow that sort of access but any help would be appreciated

I set up Immich months ago on one of my Linux machines via docker. I access it through that machines Tailscale IP and port 2283 over http.

Last week I set up Seafile on that same machine with docker and WebDAV enabled and can access it with the IP of the machine at port 8080. In order to access the seafdav on my iPhone I had to turn on https in Tailscale and sudo tailscale serv —bg IP:8080 and it works with https and magicdns.

How do I make it so I can access Immich through https at the same time on the same machine?

Hi, i'm having a hard time trying to access my services using tailscale as VPN when i'm not at home. Tailscale is giving me the error "DNS not available" and when i use my domain name to access my services (services.domain.dedyn.io) it return ERR_NAME_NOT_RESOLVED

This is my current situation:

I have adguard selfhosted and i used the following docker compose

services:
  adguard:
    image: adguard/adguardhome:latest
    container_name: adguard
    restart: unless-stopped
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "67:67/udp"
    volumes:
      - ./work:/opt/adguardhome/work
      - ./conf:/opt/adguardhome/conf
    networks:
      - caddy_net
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
      - DAC_OVERRIDE
    mem_limit: 512m
    cpus: 1.0

networks:
  caddy_net:
    name: caddy_net
    external: true

Every services is running fine on my machine at 192.168.1.88

and on adguard i have both the dns rewrite *.domain.dedyn.io -> 192.168.1.88 and the filter rules

||sh.dedyn.io^$dnsrewrite=NOERROR;A;192.168.1.88,client=192.168.1.0/24

||sh.dedyn.io^$dnsrewrite=NOERROR;A;100.90.122.98,client=100.64.0.0/10

this is my firewalld configuration (i'm using fedora server)

FedoraServer (default, active)
  target: default
  ingress-priority: 0
  egress-priority: 0
  icmp-block-inversion: no
  interfaces: eno1
  sources:
  services: dhcpv6-client
  ports:
  protocols:
  forward: yes
  masquerade: yes
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
rule family="ipv4" source address="192.168.1.0/24" service name="ssh" accept
rule family="ipv4" source address="100.64.0.0/10" forward-port port="1-65535" protocol="tcp" to-port="1-65535"
rule family="ipv4" source address="192.168.1.0/24" port port="53" protocol="udp" accept
rule family="ipv4" source address="192.168.1.0/24" port port="443" protocol="tcp" accept
rule family="ipv4" source address="192.168.1.0/24" port port="53" protocol="tcp" accept
rule family="ipv4" source address="192.168.1.0/24" port port="80" protocol="tcp" accept
rule family="ipv4" source address="192.168.1.0/24" port port="443" protocol="udp" accept

the dns and caddy are listening on all interfaces

• tcp LISTEN 0 4096 0.0.0.0:80 0.0.0.0:* users:(("docker-proxy",pid=662930,fd=8))
• tcp LISTEN 0 4096 0.0.0.0:53 0.0.0.0:* users:(("docker-proxy",pid=1047528,fd=8))

Now from tailscale

1 - i can ping my android device from tailscale dashboard
2 - i can ping my fedora server from my android device using the tailscale app

I have changed the DNS in split dns on "domain.dedyn.io" and pointed it at the tailscale ip of my fedora server

I would really like some help to know what i'm doing wrong

if you need more information don't hesitate to ask

I’m getting an auth error related to an incorrect username and password when attempting to share a network folder I have mapped in Windows 11. This network folder uses different credentials than my current Windows 11 user.

Has anyone shared a mapped network drive in Windows 11 using Taildrive before?

Hey everyone,

​I'm using Pi-hole as my main DNS server for my Tailnet, but I've run into an annoying issue: for some reason, the Tailscale IP address of the node running Pi-hole keeps changing randomly.

​Because the IP changes unexpectedly, my devices lose DNS resolution out of nowhere until I check the admin console and update my configuration.

​Context:

- ​Pi-hole is installed in the same LXC running my main Tailscale route node.

- ​The host machine has a static local IP on my LAN.

- ​There are no duplicate hostnames on my Tailnet.

​Has anyone else run into this issue?, What could cause a native Tailscale node to change its IP address like this?

​Any advice or troubleshooting tips would be greatly appreciated!