Repository navigation
馃悶 Bug: Pocket-id, APP_URL not respected聽#304
Description
Bug Description
It seems that tailscale serves Pocket id to https://pocket-id.tld even if APP_URL is set to e.g. https://id.tld
Expected Behavior
app is accessible at APP_URL
Actual Behavior
app is available at pocket-id.tld
Screenshots
No response
Operating System
Linux
Tailscale Version
1.98.4
Docker Version
29.5.2
Relevant Logs or Error Messages
Docker Compose Configuration
Environment Configuration (.env file)
Additional Context
No response
Activity
jackspiering commentedon Jun 8, 2026
Thank you @cvlc12 . I will check this out tonight.
jackspiering commentedon Jun 8, 2026
I could not figure it out yet, still investigating.
cvlc12 commentedon Jun 23, 2026
no luck on this ?
jackspiering commentedon Oct 2, 2026
Sorry for the slow follow-up, @cvlc12. I reproduced this and found the cause.
APP_URLdoes not control the name Tailscale serves on. The Tailscale machine name comes fromSERVICEin.env(the sidecar useshostname: ${SERVICE}), and Serve uses that machine'sts.netname.APP_URLonly tells Pocket ID which URL to use for its own links, OIDC endpoints, and passkeys, so the two have to match by hand.With
SERVICE=pocket-idandAPP_URL=https://id.<tailnet>.ts.net, I get exactly what you describe: the app is served athttps://pocket-id.<tailnet>.ts.net, while Pocket ID advertiseshttps://id.<tailnet>.ts.netas its issuer.To run it at
https://id.<tailnet>.ts.net:docker compose downSERVICE=idin.envand keepAPP_URL=https://id.<tailnet>.ts.net./${SERVICE}-data:mv pocket-id-data id-datadocker compose up -dThe existing machine is renamed in your tailnet, so you do not need a new auth key. If you would rather keep the machine name, set
APP_URL=https://pocket-id.<tailnet>.ts.netinstead.If
id.tldis a custom domain rather than your tailnet name, Tailscale Serve cannot serve it; it only serves the machine'sts.netname.#352 documents this in the
.envand the README.cvlc12 commentedon Oct 2, 2026
Thanks for following up on this !
I'll try it out