Join us in San Francisco for TailscaleUp!Grab your ticket ->

Set up a self-hosted provider

Last validated:
Aperture by Tailscale is currently in beta.

Configure a self-hosted LLM server as a provider in Aperture so your team can access private models through your tailnet. Any server that exposes an OpenAI-compatible chat completions endpoint works with the default configuration. Aperture supports both /v1/chat/completions and /chat/completions paths. Common servers include llama.cpp, vLLM, and Ollama.

Aperture routes requests based on the model name, not the LLM client. Any LLM client configured to use Aperture can access any provider your admin has set up. Refer to the provider compatibility reference for the full list of supported providers and API formats.

Prerequisites

Before you begin, you need:

  • An Aperture gateway accessible from your device. Refer to get started with Aperture if you have not set this up.
  • A self-hosted LLM server accessible from the Aperture host (in the tailnet or on localhost).

Configure the provider

Add your self-hosted server as a provider in your Aperture configuration:

{
  "providers": {
    "private": {
      "baseurl": "http://<self-hosted-server>:8080",
      "models": ["qwen3-coder-30b", "llama-3.1-70b"]
    }
  }
}

Replace <self-hosted-server> with the hostname or Tailscale IP address of your server. To find the correct model names, query the server's model list endpoint, typically GET /v1/models, and use the id field from the response.

Aperture appends the full incoming request path to baseurl. Most clients send /v1/chat/completions, so adding /v1 to baseurl produces /v1/v1/chat/completions. Keep baseurl at the host and port unless your clients send an unversioned path such as /chat/completions. Refer to how Aperture builds upstream URLs for details.

Self-hosted providers use openai_chat compatibility and bearer authorization by default, so no additional flags are needed for servers that expose an OpenAI-compatible API. If your server uses a different API format, set the appropriate compatibility flags.

If your server does not require authentication, omit the apikey field. If your server requires a key, add "apikey": "<your-key>" to the provider block.

Verify the provider

The best way to verify a connection to a specific model is to send a test request through the Models tab of the Aperture dashboard.

  1. Open the Aperture dashboard and select the Models tab.
  2. Find the model you want to test in the list of configured models. If the model is not listed, check your provider configuration and ensure the model name is correct.
  3. Select the Play icon to the left of the model name to send a test request. If the request succeeds, the icon changes to a green check mark. If it fails, the icon changes to a red "X".

This sends a request from your web browser to the tailnet to verify that Aperture can successfully route requests to the model through the configured provider and that your user account has the necessary permissions to access the model.

Next steps