Reaching your vault
Privately through Tailscale, directly at a domain on the internet, or directly on your own network. The installer asks, and Tailscale is one option, not a requirement.
On this page
The installer asks how you want to reach the vault before anything else, and sets it up for the answer you give. Nothing in Harbor depends on Tailscale.
| Path | What you get | What you take on |
|---|---|---|
| Privately, through Tailscale | Reachable from anywhere your devices are, over HTTPS, with nothing on the machine open to the internet. | A Tailscale account; a third-party coordination server. |
| Directly, on the internet | The vault at a domain you own, over HTTPS with a certificate from Let's Encrypt. Works from any browser, no app needed. | A domain and a DNS record; the sign-in page is visible to the whole internet. |
| Directly, on your own network | The vault on the machine's network address and a port. No account, no domain. | Plain HTTP; reachable by anything on that network. |
A VPN or mesh you already run, and headscale, fit into these too. See other ways in.
Privately, through Tailscale#
With Tailscale, the vault is reachable only from devices signed in to your tailnet, over HTTPS with a certificate Tailscale issues, and the Harbor web service does not need a public or LAN listening port. Other services on the host, such as SSH, have their own network settings. From a phone on the other side of the world it works the same as from the sofa.
Choose it in the installer and it takes care of the rest. If Tailscale is already running on the machine, the installer points it at the vault. If not, it offers to install it with the official script and sign the machine in: it prints a link, and you open it on any device and sign in.
Tailscale on the host is the better place for it. Your way in survives a Harbor that will not start, which is exactly when you need to reach the box, and Tailscale updates on its own schedule instead of riding along with app releases.
In the Tailscale admin console, turn on HTTPS Certificates under DNS. Without it the vault has no certificate to present.
If you would rather not install anything on the host, Tailscale can run as one of Harbor's containers instead. It needs an auth key from the admin console, under Settings, Keys; the installer asks for one, or takes it as TS_AUTHKEY.
Directly, on the internet#
For a cloud server, or any machine you want to reach from a browser without a VPN. The vault answers at a domain you own, such as harbor.example.com, over HTTPS.
Before you run the installer:
- Create a DNS record for the domain, an A record (or AAAA for IPv6), pointing at the machine's public address.
- Open ports 80 and 443 in your cloud provider's firewall. Port 80 is only used to obtain and renew the certificate.
Choose it in the installer and give it the domain. Harbor then runs Caddy, a web server that answers on ports 80 and 443 and obtains a certificate from Let's Encrypt on the first visit. It is the only part of Harbor listening on the machine. harbor logs caddy says why, if the certificate does not arrive; usually the DNS record does not point at the machine yet.
The installer prints a setup link with a token in it, such as https://harbor.example.com/setup?token=…. The vault creates its first account only through that link, so nobody who finds the address before you can claim it. Open it as soon as the installer finishes.
Behind a reverse proxy you already run. If something on the machine already answers on ports 80 and 443, such as Nginx Proxy Manager or Traefik, the installer notices and puts Harbor behind it instead: point your proxy's HTTPS host for the domain at the port the installer names, on 127.0.0.1. Your proxy, not Harbor, then handles the certificate. There is no setup link on this path, so create your account immediately.
Directly, on your own network#
If you prefer everything to stay on your LAN with no account and no domain, the vault publishes a port. The installer suggests the machine's own network address; set it directly with:
| Variable | Meaning |
|---|---|
HARBOR_BIND | The address to listen on, usually the machine's LAN address. 127.0.0.1 keeps it to that machine alone; 0.0.0.0 publishes it on every network the machine is on. |
HARBOR_WEB_PORT | The port. Default 3000; the installer suggests another if something already uses it. |
Other ways in#
A VPN or mesh you already run. WireGuard, or a mesh network of your own choosing, gives the box an address only your devices can reach. To Harbor that is simply your own network: choose it in the installer and give the VPN address, and the vault is reachable through the VPN and nowhere else. Harbor does not need to know the VPN exists.
headscale. If you like the Tailscale client but not the hosted coordination server, headscale is an open-source server for it that you run yourself. Sign the machine's Tailscale client in to your headscale server before running the installer, and choose Tailscale. Check your HTTPS setup separately.
HTTPS on your own network. A reverse proxy such as Caddy or nginx in front of HARBOR_WEB_PORT, with a certificate you control, adds the padlock without any tailnet or public domain.
Changing your mind#
Any of these can be switched later. harbor config changes the setting: TS_AUTHKEY for Tailscale in a container, HARBOR_DOMAIN for the internet, or HARBOR_BIND and HARBOR_WEB_PORT for your own network. Then run the installer again; it keeps your data, secrets and settings, and applies the new way in. Update WEB_ORIGIN to the new address too, and set SESSION_COOKIE_SECURE to true for an HTTPS address or false for plain HTTP. If you use Tailscale, check how its identity is stored in your deployment. A host-installed client has its own state; do not assume restoring Harbor also restores that client's identity.