Taildrive
Taildrive allows you to persistently share folders with other users and devices on your Tailscale network (known as a tailnet). Using Taildrive, you could:
- Share folders with your colleagues.
- Access files from your desktop PC or NAS server from your phone, anywhere in the world.
- Connect a backup utility, like Duplicati or rclone, to a Taildrive folder on your NAS.
How it works
Normally, maintaining a file server requires you to manage credentials and access rules separately from the connectivity layer. Taildrive offers a file server that unifies connectivity and access controls, allowing you to share directories directly from the Tailscale client. You can then use your tailnet policy file to define which members of your tailnet can access a particular shared directory, and even define specific read and write permissions.
Beginning in version 1.64.0, the Tailscale client includes a WebDAV server that runs on 100.100.100.100:8080
while Tailscale is connected. Every directory that you share receives a globally-unique path consisting of the tailnet, the machine name, and the share name: /tailnet/machine/share
.
For example, if you shared a directory with the share name docs
from the machine mylaptop
on the tailnet mydomain.com
, the share's path would be /mydomain.com/mylaptop/docs
.
Configure Taildrive
Taildrive's server component is only available on Linux, macOS, and Windows devices. iOS and Android devices can access directories shared from these platforms, but cannot share directories themselves.
Enable Taildrive in the policy file
You need to be an Owner, Admin, or Network admin to edit the tailnet policy file. Enabling Taildrive requires two steps: Enabling Taildrive on devices by setting a nodeAttr
, and defining sharing permissions using grants.
Add nodeAttrs
to enable Taildrive on devices
In order to share directories or access directories shared by other devices, you need to enable Taildrive in the nodeAttrs
section of your tailnet policy file. Edit your policy file to make this change.
For example, this policy will enable Taildrive on every member's devices. Every member of your tailnet will be able to share directories from their device and access shared directories.
"nodeAttrs": [
{
"target": ["autogroup:member"],
"attr": [
"drive:share",
"drive:access",
],
}
]
This policy enables Taildrive access on all devices, but only allows Taildrive sharing on devices owned by tailnet administrators.
"nodeAttrs": [
{
// Any device can access shared directories with Taildrive
"target": ["*"],
"attr": ["drive:access"],
},
{
// Only tailnet admins can use Taildrive to share directories
"target": ["autogroup:admin"],
"attr": [
"drive:share",
"drive:access",
],
}
]
Define sharing permissions
Once Taildrive has been enabled on your devices, you must define specific sharing permissions using grants.
The broadest possible policy allows all devices to access all shares in the tailnet, no matter which user or tag owns the device:
"grants": [
{
"src": ["*"],
"dst": ["*"],
"app": {
"tailscale.com/cap/drive": [{
"shares": ["*"],
"access": "rw"
}]
}
}
]
You may also choose to allow members to read and write to their own shared directories from any of their devices. A policy to allow this would look like:
"grants": [
{
"src": ["autogroup:member"],
"dst": ["autogroup:self"],
"app": {
"tailscale.com/cap/drive": [{
"shares": ["*"],
"access": "rw"
}]
}
}
]
You can also limit write access or even define permissions for accessing specific shares. The following policy allows all tailnet members to read files from the company-docs
share with the tag fileserver
, but does not grant access to any other shared directories besides company-docs
and does not allow write access:
Warning: Read-only mode currently permits file deletions. See this issue for details.
"grants": [
{
"src": ["autogroup:member"],
"dst": ["tag:fileserver"],
"app": {
"tailscale.com/cap/drive": [{
"shares": ["company-docs"],
"access": "ro"
}]
}
}
]
Sharing and accessing folders with Taildrive
Tailscale must be running in order be able to access Taildrive shares at 100.100.100.100:8080
.
Share directories with Taildrive
Sharing folders from Android is not supported.
Access directories shared with Taildrive
To access Taildrive, you will need a WebDAV compatible file browser app from the Play Store.
Some WebDAV explorers only work with https
URLs, but Taildrive only works on http
.
If your file browser requires a username/password for WebDAV connections, you may enter any username and password you like.
Material Files
Material Files is a free and open source file browser that works with Taildrive.
To access Taildrive from Material Files, follow these steps:
- Tap on the top-left hamburger menu.
- Select + Add storage....
- Select WebDAV server.
- Enter
100.100.100.100
for the Hostname. - Enter
8080
for the Port. - Leave Path empty.
- Enter any value for Name, such as
Tailscale
. - Select
HTTP
as the Protocol. - Select
None
for Authentication. - Tap Connect and add.
You can now see your WebDAV mount under the locations in the hamburger menu.
Limitations
- Using Taildrive with
rclone
on client version 1.64.2 or earlier will fail without the--inplace
flag. Use version 1.65.75 or later to avoid this.