feat: reach Redis over Tailscale instead of public port (OCI firewall workaround)

- Add tailscale-redis sidecar sharing Redis network namespace
- Remove public 6380:6379 port mapping — nothing exposed to internet
- Redis now reachable on tailnet as tower-redis:6379 with password auth
- Tailscale uses only outbound connections, so no OCI Security List or
  host firewall changes needed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.vps.yml

@@ -19,8 +19,6 @@ services:
   redis:
     image: redis:7-alpine
     command: redis-server --requirepass ${REDIS_PASSWORD}
-    ports:
-      - '6380:6379'
     environment:
       REDIS_PASSWORD: ${REDIS_PASSWORD}
     volumes:
@@ -34,6 +32,28 @@ services:
     networks:
       - dokploy-network
 
+  # Tailscale sidecar — shares Redis's network namespace so the Redis port
+  # becomes reachable on the tailnet as `tower-redis:6379`. Uses only outbound
+  # connections, so no OCI Security List / host firewall changes are needed.
+  tailscale-redis:
+    image: tailscale/tailscale:latest
+    hostname: tower-redis
+    environment:
+      TS_AUTHKEY: ${TS_AUTHKEY}
+      TS_STATE_DIR: /var/lib/tailscale
+      TS_USERSPACE: 'false'
+    volumes:
+      - tailscale_redis_state:/var/lib/tailscale
+    devices:
+      - /dev/net/tun
+    cap_add:
+      - NET_ADMIN
+    depends_on:
+      redis:
+        condition: service_healthy
+    restart: unless-stopped
+    network_mode: service:redis
+
   meilisearch:
     image: getmeili/meilisearch:v1.11
     ports:
@@ -126,6 +146,7 @@ volumes:
   redis_data:
   meilisearch_data:
   sessions:
+  tailscale_redis_state:
 
 networks:
   dokploy-network: