---
title: "Private deployments with Tailscale Services"
date: "2026-07-07"
---

## Private deployments with Tailscale Services

Self-hosted Fabro can now stay private to a tailnet using the new loopback-only `docker-compose.tailscale.yaml` deployment. Set `FABRO_WEB_URL` to the Tailscale Service HTTPS origin, start the compose stack, and publish it with `tailscale serve`; Tailscale handles TLS without Caddy, public DNS, or a public Fabro port. Because a Tailscale Service is private, GitHub.com cannot deliver webhooks to it—use a public webhook relay, `server_url`, or Tailscale Funnel when webhooks are required.

```bash
docker compose -f docker-compose.tailscale.yaml up -d
tailscale serve --service=svc:fabro --https=443 http://127.0.0.1:32276
```

## More

<Accordion title="Fixes">
- Automation workflow slugs now preserve kebab-case, preventing names such as `patch-cves` from being saved as the non-existent `patch_cves`; previously saved snake-case selectors require manual correction
</Accordion>
