# Tailscale on a Proxmox host

Last validated Jan 5, 2026

Proxmox is a popular open-source solution for running virtual machines and containers, built on top of a Debian Linux platform.

[Installing Tailscale][kb-install-linux] lets you access the Proxmox console from anywhere, without needing to open firewall ports or manually configure a VPN.

![Access to the Proxmox Web UI via Tailscale.](integrations/proxmox/proxmox.png)

## Enable HTTPS access to the Proxmox Web UI

The Proxmox Web UI is served over HTTPS by default on port `8006`. The default certificate is self-signed, so you will need to accept the certificate warning in your browser. With Tailscale installed on the Proxmox host, you can generate a valid certificate, removing the need to accept the warning.

The following script will use Tailscale to generate a certificate for the Proxmox host and install it in the Proxmox certificate store.

> **Note:**
>
> This script has a `jq` dependency. You may need to install `jq` on your device.
>
> With `apt`:
>
> ```shell
> apt -y install jq
> ```
>
> With `brew`:
>
> ```shell
> brew install jq
> ```

```shell
#!/bin/bash
NAME="$(tailscale status --json | jq '.Self.DNSName | .[:-1]' -r)"
tailscale cert "${NAME}"
pvenode cert set "${NAME}.crt" "${NAME}.key" --force --restart
```

(Optional) You may want to run this script as a `cron` job to ensure the certificate is kept up to date.

1. Save this script to a file. For example: `update_cert.sh`.

2. Change the file permissions to make it executable. For example:

   ```shell
   chmod +x update_cert.sh
   ```

3. Create a `cron` job entry. For example, every 12 hours:

   ```shell
   0 */12 * * * /path/to/update_cert.sh
   ```

Another option is to use [Tailscale Serve][kb-tailscale-serve] to proxy the Proxmox Web UI. This will let you access the Web UI using a valid certificate, automatically generated by Serve. In addition, you can omit the port number from the URL, as Serve can proxy the request on the default HTTPS port `443`.

```shell
sudo tailscale serve --bg https+insecure://localhost:8006
```

> **Note:**
>
> We recommend using the `--bg` flag to allow Tailscale Serve to run as a background process.

## Troubleshooting

For troubleshooting information, refer to [Troubleshooting Proxmox issues][kb-troubleshooting-proxmox].

[kb-install-linux]: /docs/install/linux

[kb-tailscale-serve]: /docs/reference/tailscale-cli/serve

[kb-troubleshooting-proxmox]: /docs/reference/troubleshooting/containers/proxmox