• English

      • Use a proxy app with built-in Tailscale for Vibelet

      If you need to keep a proxy VPN enabled on iPhone while connecting to Vibelet on a home or office computer through its Tailscale IP, use Stash or another proxy app with a built-in Tailscale node.

      The app must provide both capabilities:

      • Run Tailscale as an internal routable node.
      • Route Tailnet traffic to that node while normal traffic keeps using the existing proxy policies.

      This keeps everything in one system VPN tunnel, so the standalone Tailscale app does not need to be enabled at the same time. An app that merely recognizes the Tailscale protocol but cannot route traffic to a Tailscale node is not sufficient.

      The steps below use Stash as the concrete example. The Stash documentation describes this model: add Tailscale as a type: tailscale proxy and route selected traffic to it. See the official Stash Tailscale documentation. Other compatible apps may use different node and rule syntax, so do not copy this YAML unchanged.

      1. Start Vibelet on the computer

      Make sure the computer has joined your tailnet, then find its Tailscale IPv4 address, such as 100.x.y.z.

      npx vibelet --access=<computer-tailscale-ip>

      Vibelet listens on port 9876 by default. From another device on the same tailnet, check:

      http://<computer-tailscale-ip>:9876/health

      2. Add a Tailscale node to Stash

      Add this node to your existing Stash configuration. hostname may contain only lowercase letters, numbers, and hyphens:

      proxies:
  - name: Tailnet
    type: tailscale
    hostname: vibelet-iphone
    ephemeral: false
    benchmark-url: http://<computer-tailscale-ip>:9876/health
    benchmark-timeout: 10

      This example intentionally omits auth-key, so a credential is not stored in a configuration file that might be synced or shared.

      After saving and loading the configuration, find the Tailnet node in Stash, open its node menu, choose Tailscale Authentication, and sign in to authorize the Stash device.

      3. Route Tailnet traffic to the node

      Place these rules before broad proxy rules and the final MATCH / FINAL rule:

      rules:
  - DOMAIN-SUFFIX,ts.net,Tailnet
  - IP-CIDR,100.64.0.0/10,Tailnet,no-resolve
  - IP-CIDR6,fd7a:115c:a1e0::/48,Tailnet,no-resolve

      To expose only one Vibelet computer, narrow the domain rule to its full MagicDNS name:

      - DOMAIN,<computer-hostname>.<tailnet-name>.ts.net,Tailnet

      These rules affect only Tailnet traffic. Your existing regional nodes, automatic selection, ad blocking, and other proxy policies can remain unchanged.

      4. Check Skip Route

      Open Stash's Skip Route setting or the corresponding override and make sure it does not contain:

      100.64.0.0/10

      This matters because skipped traffic never enters the Stash TUN and cannot match the Tailnet node. The usual symptom is a successfully authenticated node with a Vibelet /health request that always times out.

      5. Verify the path

      Check each layer in this order:

      1. The Tailnet node is authenticated and shows latency in Stash.
      2. Safari can open http://<computer-tailscale-ip>:9876/health.
      3. The saved Vibelet device uses the computer's Tailscale IP or MagicDNS name, not a Cloudflare address.
      4. The request appears in Stash's active connections and matches the Tailnet node.
      5. Normal websites still match your existing proxy policies, confirming that the proxy VPN and Tailscale work together.

      If the node shows latency but /health times out, check Skip Route and rule order before repeating Tailscale authentication.