# Private network access with Tailscale

> Reach your application's databases over your own tailnet with the Tailscale service, with no public ports.

## Private network access with Tailscale

The Tailscale service lets you reach your application's databases and other services over your own tailnet, without exposing a public port and without an SSH tunnel. The service joins your tailnet as its own device, and each of your application's databases becomes reachable on that device at the database's normal port.

The Tailscale service is free and does not count towards your usage.

### Before you start

- A Tailscale account and tailnet. The free plan is enough.
- Permission to create auth keys on that tailnet (Owner, Admin, or Network admin).
- Tailscale installed and signed in on the devices that will connect.

### Add the tag to your tailnet

The service identifies itself with the tag `tag:ploicloud`. In your Tailscale access controls, make sure the policy owns that tag:

```
"tagOwners": {
  "tag:ploicloud": ["autogroup:admin"]
}
```

Save the policy before continuing.

### Create an auth key

In your Tailscale admin, open Settings and then Keys. Generate an auth key and assign it the tag `tag:ploicloud`. Copy the key, which starts with `tskey-auth-`.

The key **must be reusable**. A single-use key registers the node once and the node cannot reconnect after a restart. The key is only used the first time the node connects, so its expiry does not affect a running service; you only need a fresh key when you add a new service later. One reusable key can be shared by every Tailscale service in your account.

### Add the Tailscale service

1. Open your application.
2. Click Add service and choose Tailscale under Connectivity.
3. Paste your auth key into the auth key field.
4. Control server is optional. Leave it empty to use Tailscale, or enter your Headscale URL to use a self-hosted, European control server.
5. Create the service.

The service joins your tailnet as a device named `ploicloud-` followed by your application name.

### Connect to a database

Open the Private network card on your application overview and click View connections. You will see the node name, the control server, and each database with its address and port.

Connect from any device on your tailnet using the node name (or its Tailscale IP) as the host, on the port shown:

```
mysql -h ploicloud-your-app -P 3306 -u your-user -p
psql "postgresql://your-user:your-password@ploicloud-your-app:5432/your-database"
redis-cli -h ploicloud-your-app -p 6379
```

There is no public port, no SSH tunnel, and nothing to approve. Access is controlled entirely by your tailnet.

### Adding or removing databases

When you add or remove a database, the Tailscale service updates on its own so the current set of databases is always reachable. There is nothing to restart. While it updates, connections through the service reconnect briefly.

If two databases use the same default port, the first one keeps the default port and the next one uses the following port. The View connections panel always shows the exact port to use for each database.

### Use your own control server with Headscale

By default the service uses Tailscale's coordination servers. To keep everything on your own self-hosted, European control plane, run Headscale and enter its URL in the Control server field when you add the service. Define the `tag:ploicloud` tag in your Headscale policy instead of the Tailscale admin. Everything else works the same way.

### Cost

The Tailscale service is free and does not count towards your usage.