{"slug":"register-a-tsnet-application-as-a-tailscale-service","title":"Register a tsnet application as a Tailscale Service","tags":["tailscale"],"agent_summary":"Last validated: Jan 27, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Register a tsnet application as a Tailscale Service\r\n\r\nLast validated: Jan 27, 2026\r\n\r\n## [Introduction](https://tailscale.com/docs/features/tsnet/how-to/register-service\\#introduction)\r\n\r\nIn this guide you will use the [`tsnet`](https://tailscale.com/docs/features/tsnet) package to register an application as a [Tailscale Service](https://tailscale.com/docs/features/tailscale-services) host. This pattern can be applied to other `tsnet` applications.\r\n\r\nThe example code for this demo is available in the [`tailscale/tailscale` repository](https://github.com/tailscale/tailscale/blob/v1.94.1/tsnet/example/tsnet-services/tsnet-services.go).\r\n\r\n## [Prerequisites](https://tailscale.com/docs/features/tsnet/how-to/register-service\\#prerequisites)\r\n\r\nBefore you begin this guide you'll need the following:\r\n\r\n- The [Go compiler toolchain](https://go.dev/dl).\r\n- A terminal window (command prompt).\r\n- An active tailnet.\r\n- One or more devices running Tailscale v1.86.0 or later.\r\n- [Owner, Admin, or Network admin](https://tailscale.com/docs/reference/user-roles) account permissions.\r\n\r\n## [Step 1: Update your tailnet policy file](https://tailscale.com/docs/features/tsnet/how-to/register-service\\#step-1-update-your-tailnet-policy-file)\r\n\r\nAdd `tagOwners`, `autoApprovers`, and `grants` to your tailnet policy file.\r\n\r\n### [Create a tag](https://tailscale.com/docs/features/tsnet/how-to/register-service\\#create-a-tag)\r\n\r\nUse the Tailscale admin console to create a [Tailscale tag](https://tailscale.com/docs/features/tags).\r\n\r\n1. Open the [Access controls](https://login.tailscale.com/admin/acls) page of the admin console.\r\n\r\n2. Select the **Tags** pane.\r\n\r\n3. Select **Create tag**.\r\n\r\n4. Add the **Tag name**.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```json\r\ntsnet-demo-host\r\n```\r\n\r\n5. Add the **Tag owner**.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```json\r\nautogroup:member\r\n```\r\n\r\n6. Select **Save**.\r\n\r\n\r\n### [Define a service](https://tailscale.com/docs/features/tsnet/how-to/register-service\\#define-a-service)\r\n\r\nUse the Tailscale admin console to add a Tailscale Service.\r\n\r\n1. Open the [Services](https://login.tailscale.com/admin/services) page of the admin console.\r\n\r\n2. Select the **Advertised** pane.\r\n\r\n3. Select **Define Service**.\r\n\r\n4. Add the **Service name**.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```json\r\ntsnet-demo\r\n```\r\n\r\n5. Add the **Ports**.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```json\r\n443\r\n```\r\n\r\n6. Select **Define Service**.\r\n\r\n\r\nFor the purposes of this example, the Service will not require a tag.\r\n\r\n### [Define auto approval](https://tailscale.com/docs/features/tsnet/how-to/register-service\\#define-auto-approval)\r\n\r\nUse the Tailscale admin console to add auto approval.\r\n\r\n1. Open the [Access controls](https://login.tailscale.com/admin/acls) page of the admin console.\r\n\r\n2. Select the **Auto approvers** pane.\r\n\r\n3. Select the **Select service** dropdown and choose the example service.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```json\r\nsvc:tsnet-demo\r\n```\r\n\r\n4. Select the **Service can automatically accept devices** dropdown and choose the example tag.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```json\r\ntag:tsnet-demo-host\r\n```\r\n\r\n5. Select **Save service auto approver**.\r\n\r\n\r\n### [Define grants](https://tailscale.com/docs/features/tsnet/how-to/register-service\\#define-grants)\r\n\r\nUse the Tailscale admin console to add grants.\r\n\r\n1. Open the [Access controls](https://login.tailscale.com/admin/acls) page of the admin console.\r\n\r\n2. Select the **General access rule** pane.\r\n\r\n3. Select **Add rule**.\r\n\r\n4. Add **All users and devices** for **Source**.\r\n\r\n5. Add the example service for **Destination**.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```json\r\nsvc:tsnet-demo\r\n```\r\n\r\n6. Add \\*\\*All ports and protocols\" for **Port and protocol**.\r\n\r\n7. Select **Save grant**.\r\n\r\n\r\n### [Example tailnet policy file](https://tailscale.com/docs/features/tsnet/how-to/register-service\\#example-tailnet-policy-file)\r\n\r\nAt this point, your policy file should include:\r\n\r\n```json\r\n\"tagOwners\": {\r\n \"tag:tsnet-demo-host\": [\"autogroup:member\"],\r\n},\r\n\"autoApprovers\": {\r\n \"services\": {\r\n \"svc:tsnet-demo\": [\"tag:tsnet-demo-host\"],\r\n },\r\n},\r\n\"grants\": [\\\r\n \"src\": [\"*\"],\\\r\n \"dst\": [\"svc:tsnet-demo\"],\\\r\n \"ip\": [\"*\"],\\\r\n],\r\n```\r\n\r\n## [Step 2: Generate an auth key](https://tailscale.com/docs/features/tsnet/how-to/register-service\\#step-2-generate-an-auth-key)\r\n\r\nUse the Tailscale admin console to [generate an auth key](https://tailscale.com/docs/features/access-control/auth-keys#generate-an-auth-key).\r\n\r\n1. Open the [Keys](https://login.tailscale.com/admin/settings/keys) page of the admin console.\r\n2. Select **Generate auth key**.\r\n3. Enable **Tags**.\r\n4. Select **Add tags** and choose the example tag.\r\n5. Select **Generate key**.\r\n6. Copy the auth key to your clipboard for use later.\r\n7. Select **Done**.\r\n\r\nOpen a command terminal and save the auth key as an environment variable.\r\n\r\n```shell\r\nexport TS_AUTHKEY=\r\n```\r\n\r\n## [Step 3: Use the `tsnet` package](https://tailscale.com/docs/features/tsnet/how-to/register-service\\#step-3-use-the-tsnet-package)\r\n\r\n1. Open your text editor.\r\n2. Create a `tsnet-services.go` file:\r\n\r\n```go\r\npackage main\r\n\r\nimport (\r\n\t\"flag\"\r\n\t\"fmt\"\r\n\t\"log\"\r\n\t\"net/http\"\r\n\r\n\t\"tailscale.com/tsnet\"\r\n)\r\n\r\nvar (\r\n\tsvcName = flag.String(\"service\", \"\", \"the name of your Service, e.g. svc:tsnet-demo\")\r\n)\r\n\r\nfunc main() {\r\n\tflag.Parse()\r\n\tif *svcName == \"\" {\r\n\t\tlog.Fatal(\"a Service name must be provided\")\r\n\t}\r\n\r\n\ts := &tsnet.Server{\r\n\t\tHostname: \"tsnet-services-demo\",\r\n\t}\r\n\tdefer s.Close()\r\n\r\n\tln, err := s.ListenService(*svcName, tsnet.ServiceModeHTTP{\r\n\t\tHTTPS: true,\r\n\t\tPort: 443,\r\n\t})\r\n\tif err != nil {\r\n\t\tlog.Fatal(err)\r\n\t}\r\n\tdefer ln.Close()\r\n\r\n\tlog.Printf(\"Listening on https://%v\\n\", ln.FQDN)\r\n\r\n\terr = http.Serve(ln, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\r\n\t\tfmt.Fprintln(w, \"

Hello, tailnet!

\")\r\n\t}))\r\n\tlog.Fatal(err)\r\n}\r\n```\r\n\r\nIn this example program, you will create a `tsnet.Server` instance with the hostname `tsnet-services-demo`. This server acts as a virtual node on your tailnet. The program instructs the node to listen for HTTPS connections to a Service on port `443`. The listener uses the `tsnet` package's [`ListenService`](https://tailscale.com/docs/reference/tsnet-server-api#serverlistenservice) and `ServiceModeHTTP`. The program also uses the Go standard library's `net/http` package to run an HTTP server on top of the listener. When other nodes on the tailnet connect to the Service, those connections will be routed to the virtual node defined by this program.\r\n\r\n## [Step 4: Run the program](https://tailscale.com/docs/features/tsnet/how-to/register-service\\#step-4-run-the-program)\r\n\r\n1. Run the command:\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\ngo run tsnet-services.go --service=svc:tsnet-demo\r\n```\r\n\r\n\r\n## [Step 5: Connect to the application](https://tailscale.com/docs/features/tsnet/how-to/register-service\\#step-5-connect-to-the-application)\r\n\r\n1. Visit the example server:\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```markup\r\nopen https://tsnet-demo.\r\n```\r\n\r\n\r\nFor more information about tailnet DNS names, refer to [tailnet name](https://tailscale.com/docs/concepts/tailnet-name#tailnet-dns-name).\r\n\r\n## [Conclusion](https://tailscale.com/docs/features/tsnet/how-to/register-service\\#conclusion)\r\n\r\nThis pattern can be applied to other `tsnet` applications as Tailscale Services hosts.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Register a tsnet application as a Tailscale Service

\n

Last validated: Jan 27, 2026

\n

Introduction

\n

In this guide you will use the tsnet package to register an application as a Tailscale Service host. This pattern can be applied to other tsnet applications.

\n

The example code for this demo is available in the tailscale/tailscale repository.

\n

Prerequisites

\n

Before you begin this guide you'll need the following:

\n\n

Step 1: Update your tailnet policy file

\n

Add tagOwners, autoApprovers, and grants to your tailnet policy file.

\n

Create a tag

\n

Use the Tailscale admin console to create a Tailscale tag.

\n
    \n
  1. \n

    Open the Access controls page of the admin console.

    \n
    2. \n
  2. \n

    Select the Tags pane.

    \n
    3. \n
  3. \n

    Select Create tag.

    \n
    4. \n
  4. \n

    Add the Tag name.

    \n
    5. \n
\n
tsnet-demo-host\n
\n
    \n
  1. Add the Tag owner.
    2. \n
\n
autogroup:member\n
\n
    \n
  1. Select Save.
    2. \n
\n

Define a service

\n

Use the Tailscale admin console to add a Tailscale Service.

\n
    \n
  1. \n

    Open the Services page of the admin console.

    \n
    2. \n
  2. \n

    Select the Advertised pane.

    \n
    3. \n
  3. \n

    Select Define Service.

    \n
    4. \n
  4. \n

    Add the Service name.

    \n
    5. \n
\n
tsnet-demo\n
\n
    \n
  1. Add the Ports.
    2. \n
\n
443\n
\n
    \n
  1. Select Define Service.
    2. \n
\n

For the purposes of this example, the Service will not require a tag.

\n

Define auto approval

\n

Use the Tailscale admin console to add auto approval.

\n
    \n
  1. \n

    Open the Access controls page of the admin console.

    \n
    2. \n
  2. \n

    Select the Auto approvers pane.

    \n
    3. \n
  3. \n

    Select the Select service dropdown and choose the example service.

    \n
    4. \n
\n
svc:tsnet-demo\n
\n
    \n
  1. Select the Service can automatically accept devices dropdown and choose the example tag.
    2. \n
\n
tag:tsnet-demo-host\n
\n
    \n
  1. Select Save service auto approver.
    2. \n
\n

Define grants

\n

Use the Tailscale admin console to add grants.

\n
    \n
  1. \n

    Open the Access controls page of the admin console.

    \n
    2. \n
  2. \n

    Select the General access rule pane.

    \n
    3. \n
  3. \n

    Select Add rule.

    \n
    4. \n
  4. \n

    Add All users and devices for Source.

    \n
    5. \n
  5. \n

    Add the example service for Destination.

    \n
    6. \n
\n
svc:tsnet-demo\n
\n
    \n
  1. \n

    Add **All ports and protocols\" for Port and protocol.

    \n
    2. \n
  2. \n

    Select Save grant.

    \n
    3. \n
\n

Example tailnet policy file

\n

At this point, your policy file should include:

\n
\"tagOwners\": {\r\n  \"tag:tsnet-demo-host\": [\"autogroup:member\"],\r\n},\r\n\"autoApprovers\": {\r\n  \"services\": {\r\n    \"svc:tsnet-demo\": [\"tag:tsnet-demo-host\"],\r\n  },\r\n},\r\n\"grants\": [\\\r\n  \"src\": [\"*\"],\\\r\n  \"dst\": [\"svc:tsnet-demo\"],\\\r\n  \"ip\": [\"*\"],\\\r\n],\n
\n

Step 2: Generate an auth key

\n

Use the Tailscale admin console to generate an auth key.

\n
    \n
  1. Open the Keys page of the admin console.
    2. \n
  2. Select Generate auth key.
    3. \n
  3. Enable Tags.
    4. \n
  4. Select Add tags and choose the example tag.
    5. \n
  5. Select Generate key.
    6. \n
  6. Copy the auth key to your clipboard for use later.
    7. \n
  7. Select Done.
    8. \n
\n

Open a command terminal and save the auth key as an environment variable.

\n
export TS_AUTHKEY=<your-authkey>\n
\n

Step 3: Use the tsnet package

\n
    \n
  1. Open your text editor.
    2. \n
  2. Create a tsnet-services.go file:
    3. \n
\n
package main\r\n\r\nimport (\r\n\t\"flag\"\r\n\t\"fmt\"\r\n\t\"log\"\r\n\t\"net/http\"\r\n\r\n\t\"tailscale.com/tsnet\"\r\n)\r\n\r\nvar (\r\n\tsvcName = flag.String(\"service\", \"\", \"the name of your Service, e.g. svc:tsnet-demo\")\r\n)\r\n\r\nfunc main() {\r\n\tflag.Parse()\r\n\tif *svcName == \"\" {\r\n\t\tlog.Fatal(\"a Service name must be provided\")\r\n\t}\r\n\r\n\ts := &tsnet.Server{\r\n\t\tHostname: \"tsnet-services-demo\",\r\n\t}\r\n\tdefer s.Close()\r\n\r\n\tln, err := s.ListenService(*svcName, tsnet.ServiceModeHTTP{\r\n\t\tHTTPS: true,\r\n\t\tPort:  443,\r\n\t})\r\n\tif err != nil {\r\n\t\tlog.Fatal(err)\r\n\t}\r\n\tdefer ln.Close()\r\n\r\n\tlog.Printf(\"Listening on https://%v\\n\", ln.FQDN)\r\n\r\n\terr = http.Serve(ln, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\r\n\t\tfmt.Fprintln(w, \"<html><body><h1>Hello, tailnet!</h1>\")\r\n\t}))\r\n\tlog.Fatal(err)\r\n}\n
\n

In this example program, you will create a tsnet.Server instance with the hostname tsnet-services-demo. This server acts as a virtual node on your tailnet. The program instructs the node to listen for HTTPS connections to a Service on port 443. The listener uses the tsnet package's ListenService and ServiceModeHTTP. The program also uses the Go standard library's net/http package to run an HTTP server on top of the listener. When other nodes on the tailnet connect to the Service, those connections will be routed to the virtual node defined by this program.

\n

Step 4: Run the program

\n
    \n
  1. Run the command:
    2. \n
\n
go run tsnet-services.go --service=svc:tsnet-demo\n
\n

Step 5: Connect to the application

\n
    \n
  1. Visit the example server:
    2. \n
\n
open https://tsnet-demo.<your-tailnet-DNS-name>\n
\n

For more information about tailnet DNS names, refer to tailnet name.

\n

Conclusion

\n

This pattern can be applied to other tsnet applications as Tailscale Services hosts.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}