tailscale-serve
Share a local server, file, or directory on your tailnet
TLDR
SYNOPSIS
tailscale serve [flags] targettailscale serve status [--json]tailscale serve reset | drain service | advertise service
DESCRIPTION
tailscale serve shares a local service, file, directory, or static text with devices on your Tailscale network (tailnet). It is a tailscale subcommand, not a separate binary. Traffic stays inside the tailnet. Use tailscale funnel when the endpoint must be on the public internet.HTTPS uses a certificate Tailscale provisions for the node. Targets can reverse-proxy a local HTTP server, serve files (requires root on Linux), or return static text. TCP mode forwards raw or TLS-terminated streams to a local TCP server.With --bg, serve survives reboot and `tailscale down` / `tailscale up`. Without --bg, you must start it again after a restart. Serve for Tailscale Services runs in the background by default.
PARAMETERS
target
Port (`3000`), host:port (`localhost:3000`), URL (`https+insecure://localhost:8443`), absolute file or directory path, or `text:` followed by a static string.--bg
Run in the background until disabled.--https=port
HTTPS listener port (default). Certificates are provisioned automatically.--http=port
HTTP listener port. HTTP is reachable on short MagicDNS names such as `http://my-node`.--set-path=path
Mount the service at a slash-separated URL path.--tcp=port
Raw TCP forwarder on port.--tls-terminated-tcp=port
TLS-terminated TCP forwarder on port.--proxy-protocol=1|2
PROXY protocol version for TCP forwarding (typically 2).--service=virtual-ip
Serve for a Tailscale Service virtual IP instead of this device's address.--tun
Layer 3 Service that forwards all traffic to the local machine (Services only).--accept-app-caps=caps
App capabilities to forward, comma-separated.--yes
Update without interactive prompts.off
Remove this serve mapping. Original flags are required; target is optional.status [--json]
List servers currently configured on this device.reset
Clear the current serve configuration.drain service
Stop accepting new connections for a Service (`svc:name`) without dropping existing ones.advertise service
Advertise this node as a Service host.
INSTALL
CAVEATS
Funnel and Serve CLI flags changed in Tailscale 1.52. File and directory serving needs root on Linux (`sudo tailscale serve /path`). Reverse-proxy targets only support `http://127.0.0.1` backends. macOS App Store and Standalone variants can share ports but not files, because of the app sandbox. status and status --json do not return the same fields; get-config --all lists Services.
SEE ALSO
tailscale(1), tailscale-funnel(1), tailscale-up(1)
