[Feature] Tailscale

[nteichmann-obm]

Got an idea? Nice! 💡 We love hearing what features would make PegaProx better for you.

A friendly reminder: PegaProx is built by volunteers in our spare time. We can't promise timelines or guarantee every feature will be implemented — but every suggestion helps shape the roadmap!

Want to help move things faster?

• 💖 Become a Sponsor — sponsored features get prioritized
• ⭐ Star the project — helps with visibility
• 🤝 Even better: submit a PR with your idea!

---

Describe the feature

Connect to PVE clusters via Tailscale

Use Case

I have over 10 PVE cluster that are accessed via Tailscale. I was hoping to access and manage them with PegaProx.

Alternatives considered

I have tried both using Tailscale IP's and Internal IP's

How important is this for you?

This Blocking my use csae to prove out your tool.

Checklist

• I have searched existing issues and discussions to make sure this hasn't been requested before
  yes

[MrMasterbay]

Tailscale is indeed supported as we also use Netbird internally.

You need to add them with the tailscale ip and allow ssh otherwise it will not work.

[mkellermann97]

Hi @nteichmann-obm — Tailscale should already work in principle since it just hands you a regular routable IP (100.x or the magic-DNS `*.ts.net` hostname) and PegaProx talks to PVE over plain HTTPS:8006 + SSH. Nothing in our stack treats Tailscale specially.

Two usual stumbling blocks though:

1. TLS cert mismatch — your PVE certs aren't issued for the Tailscale hostname, so Python's TLS verify chokes. Toggle off SSL-Verification in the cluster's "Reconfigure cluster" dialog and try again.
2. SSH reachable on the Tailscale IP — PegaProx auto-detects the management IP from Proxmox itself, which usually returns the LAN IP of vmbr0 (not the Tailscale one). If the Proxmox host advertises only its LAN IP, our SSH calls will try the LAN address (unreachable from your client). Workaround: in the cluster config, set `ssh_user` and explicitly enter the Tailscale hostname/IP as `host`.

Could you share what fails exactly? PegaProx log lines starting with `[NodeIP]` or `SSH connect failed` would tell us which of the two it is. With those we can either fix it properly or document the right config.

— Marcus

[nteichmann-obm]

Thank you very much for your quick response! I am going to bother my Network Architect and see why it is failing. I can reach everything via ssh and 8006 it is timing out which is not good for me. Love the product! Cheers, [A blue circle with white text Description automatically generated] Hodgie Teichmann Network and Infrastructure 309.831.8826 (CST/CDT) OBM<http://obm.io/> | Foreman<http://foreman.mn/> | RTS<https://obm.io/rts> 2425 Rye Street, Suite 3201 Baltimore, MD 21230 [https://lh7-rt.googleusercontent.com/docsz/AD_4nXcfEm1CeVw6V5_UFSn_UAkzEWb-kJvtUSifMIimAasdHNyLhXqfDGUA_6Me39MpZvy8Nez9Dqd14L_wx8c6lWULWIhydGJjq7ENOwsMw1C4RnLjBVemFxdu4u99rbZxxLqRLf_357xgWjY0J-N8fV0B_xPe?key=nhCdIK4bDhn_nCmPENGVjA]<https://twitter.com/foremanmining?lang=en> [https://lh7-rt.googleusercontent.com/docsz/AD_4nXep3MaL6aGz2cLRd1N8o-D7gx4h_8Kd3mSj7gBvVdwT8b4x1xoY5s4CMFUunjISXpJ6YIJ1Wtl_kggaDAN1F6APsn6XW__NszWzBVmt2R28HImQcC1iHYvEK-fp5Nt1PqB-lYErUEaQngXwoYK2isLdDlu6?key=nhCdIK4bDhn_nCmPENGVjA]<https://www.youtube.com/channel/UCm0RnOG6F0mQxC2pdG4JwPQ> From: mkellermann97 ***@***.***> Date: Thursday, April 30, 2026 at 9:23 AM To: PegaProx/project-pegaprox ***@***.***> Cc: nteichmann-obm ***@***.***>; Mention ***@***.***> Subject: Re: [PegaProx/project-pegaprox] [Feature] Tailscale (Issue #361) [https://avatars.githubusercontent.com/u/257130705?s=20&v=4]mkellermann97 left a comment (PegaProx/project-pegaprox#361)<#361 (comment)> Hi @nteichmann-obm<https://github.com/nteichmann-obm> — Tailscale should already work in principle since it just hands you a regular routable IP (100.x or the magic-DNS `*.ts.net` hostname) and PegaProx talks to PVE over plain HTTPS:8006 + SSH. Nothing in our stack treats Tailscale specially. Two usual stumbling blocks though: 1. TLS cert mismatch — your PVE certs aren't issued for the Tailscale hostname, so Python's TLS verify chokes. Toggle off SSL-Verification in the cluster's "Reconfigure cluster" dialog and try again. 2. SSH reachable on the Tailscale IP — PegaProx auto-detects the management IP from Proxmox itself, which usually returns the LAN IP of vmbr0 (not the Tailscale one). If the Proxmox host advertises only its LAN IP, our SSH calls will try the LAN address (unreachable from your client). Workaround: in the cluster config, set `ssh_user` and explicitly enter the Tailscale hostname/IP as `host`. Could you share what fails exactly? PegaProx log lines starting with `[NodeIP]` or `SSH connect failed` would tell us which of the two it is. With those we can either fix it properly or document the right config. — Marcus — Reply to this email directly, view it on GitHub<#361 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/CC5NNIXYU5FCEC2DOK7MDZL4YNOXTAVCNFSM6AAAAACYMC32QSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DGNJTGI3DAOJSGI>. Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you were mentioned.

[nteichmann-obm]

Thank you for your quick response. I am asking my Network Architect investigate. I can reach the PVE webui via both the Tailscale IP and internal and ssh to both. Cheers, [A blue circle with white text Description automatically generated] Hodgie Teichmann Network and Infrastructure 309.831.8826 (CST/CDT) OBM<http://obm.io/> | Foreman<http://foreman.mn/> | RTS<https://obm.io/rts> 2425 Rye Street, Suite 3201 Baltimore, MD 21230 [https://lh7-rt.googleusercontent.com/docsz/AD_4nXcfEm1CeVw6V5_UFSn_UAkzEWb-kJvtUSifMIimAasdHNyLhXqfDGUA_6Me39MpZvy8Nez9Dqd14L_wx8c6lWULWIhydGJjq7ENOwsMw1C4RnLjBVemFxdu4u99rbZxxLqRLf_357xgWjY0J-N8fV0B_xPe?key=nhCdIK4bDhn_nCmPENGVjA]<https://twitter.com/foremanmining?lang=en> [https://lh7-rt.googleusercontent.com/docsz/AD_4nXep3MaL6aGz2cLRd1N8o-D7gx4h_8Kd3mSj7gBvVdwT8b4x1xoY5s4CMFUunjISXpJ6YIJ1Wtl_kggaDAN1F6APsn6XW__NszWzBVmt2R28HImQcC1iHYvEK-fp5Nt1PqB-lYErUEaQngXwoYK2isLdDlu6?key=nhCdIK4bDhn_nCmPENGVjA]<https://www.youtube.com/channel/UCm0RnOG6F0mQxC2pdG4JwPQ> From: Nico Schmidt ***@***.***> Date: Thursday, April 30, 2026 at 7:07 AM To: PegaProx/project-pegaprox ***@***.***> Cc: nteichmann-obm ***@***.***>; Author ***@***.***> Subject: Re: [PegaProx/project-pegaprox] [Feature] Tailscale (Issue #361) [https://avatars.githubusercontent.com/u/77726945?s=20&v=4]MrMasterbay left a comment (PegaProx/project-pegaprox#361)<#361 (comment)> Tailscale is indeed supported as we also use Netbird internally. You need to add them with the tailscale ip and allow ssh otherwise it will not work. — Reply to this email directly, view it on GitHub<#361 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/CC5NNIWOAADQN3XOTOCE6KD4YM6ZRAVCNFSM6AAAAACYMC32QSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DGNJSGMYDMMRZGM>. Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you authored the thread.

[MrMasterbay]

Closing this as we think its not on our side.
Feel free to write @MrMasterbay or @mkellermann97 to let us know. If it is on our side.