From 7cafbc8ba6b3fe1456aab7d93ddfd601b04ae743 Mon Sep 17 00:00:00 2001
From: maaz519 <maaz@insigniaconsultancy.com>
Date: Fri, 19 Jun 2026 17:58:45 +0530
Subject: [PATCH] feat: reach Redis over Tailscale instead of public port (OCI
 firewall workaround)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add tailscale-redis sidecar sharing Redis network namespace
- Remove public 6380:6379 port mapping — nothing exposed to internet
- Redis now reachable on tailnet as tower-redis:6379 with password auth
- Tailscale uses only outbound connections, so no OCI Security List or
  host firewall changes needed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 docker-compose.vps.yml | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/docker-compose.vps.yml b/docker-compose.vps.yml
index 6fb90e4..fc7e3c3 100644
--- a/docker-compose.vps.yml
+++ b/docker-compose.vps.yml
@@ -19,8 +19,6 @@ services:
   redis:
     image: redis:7-alpine
     command: redis-server --requirepass ${REDIS_PASSWORD}
-    ports:
-      - '6380:6379'
     environment:
       REDIS_PASSWORD: ${REDIS_PASSWORD}
     volumes:
@@ -33,7 +31,29 @@ services:
     restart: unless-stopped
     networks:
       - dokploy-network
- 
+
+  # Tailscale sidecar — shares Redis's network namespace so the Redis port
+  # becomes reachable on the tailnet as `tower-redis:6379`. Uses only outbound
+  # connections, so no OCI Security List / host firewall changes are needed.
+  tailscale-redis:
+    image: tailscale/tailscale:latest
+    hostname: tower-redis
+    environment:
+      TS_AUTHKEY: ${TS_AUTHKEY}
+      TS_STATE_DIR: /var/lib/tailscale
+      TS_USERSPACE: 'false'
+    volumes:
+      - tailscale_redis_state:/var/lib/tailscale
+    devices:
+      - /dev/net/tun
+    cap_add:
+      - NET_ADMIN
+    depends_on:
+      redis:
+        condition: service_healthy
+    restart: unless-stopped
+    network_mode: service:redis
+
   meilisearch:
     image: getmeili/meilisearch:v1.11
     ports:
@@ -126,6 +146,7 @@ volumes:
   redis_data:
   meilisearch_data:
   sessions:
+  tailscale_redis_state:
 
 networks:
   dokploy-network: