# How to setup traefik with tailscale on docker compose but only gate some services behind tailscale?

**URL:** <https://community.traefik.io/t/how-to-setup-traefik-with-tailscale-on-docker-compose-but-only-gate-some-services-behind-tailscale/26434>\
**Category:** Traefik v3 (latest)\
**Tags:** middleware, docker\
**Created:** [February 10, 2025, 3:31am UTC](https://community.traefik.io/t/how-to-setup-traefik-with-tailscale-on-docker-compose-but-only-gate-some-services-behind-tailscale/26434 "2025-02-10T03:31:10Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ROODAY](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/rooday/32/6248_2.png) [@ROODAY](https://community.traefik.io/u/ROODAY)\
**Post date:** [February 10, 2025, 3:31am UTC](https://community.traefik.io/t/how-to-setup-traefik-with-tailscale-on-docker-compose-but-only-gate-some-services-behind-tailscale/26434/1 "2025-02-10T03:31:10Z")

</div>

I currently have a homelab where everything is a docker container, described in a docker compose file. I use cloudlfare for DNS and SSL certs, and have it configured so that I just need to add labels to containers to give them a URL. E.g.

```auto
  traefik:
    image: traefik
    container_name: traefik
    restart: always
    volumes:
      - /home/traefik/letsencrypt:/letsencrypt
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - 80:80
      - 443:443
    environment:
      - CLOUDFLARE_EMAIL=xxx
      - CLOUDFLARE_API_KEY=xxx
    command:
      - --accesslog=true
      - --providers.docker=true
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.cloudflare.acme.dnschallenge=true
      - --certificatesresolvers.cloudflare.acme.dnschallenge.provider=cloudflare
      - --certificatesresolvers.cloudflare.acme.email=xxx
      - --certificatesresolvers.cloudflare.acme.storage=/letsencrypt/acme.json
  plex:
    image: lscr.io/linuxserver/plex:latest
    container_name: plex
    ports:
      - 32400:32400
    environment:
      - PUID=1000
      - PGID=1000
      - VERSION=docker
    volumes:
      - /home/plex:/config
      - /servercontent/media:/data/media
      - /tmp/plex:/transcode
    restart: unless-stopped
    labels:
      - traefik.enable=true
      - traefik.http.routers.plex.rule=Host(`plex.domain.com`)
      - traefik.http.services.plex.loadbalancer.server.port=32400
      - traefik.http.routers.plex.entrypoints=websecure
      - traefik.http.routers.plex.tls.certresolver=cloudflare

```

What I would like to do is add tailscale, and have only a subset of my services behind it. E.g. if I had some webservice called [service.domain.com](http://service.domain.com) currently accessible publicly, I'd want it to still have that domain, but require being on the tailnet. But leave other services, e.g. plex, still accessible off the tailnet. I found guides like this: [Securing Your Homelab with Tailscale and Cloudflare Wildcard DNS | by Sven van Ginkel | Medium](https://medium.com/@svenvanginkel/your-homelab-behind-tailscale-with-wildcard-dns-and-certificates-c68a881900bf), however that makes all services behind traefik on the tailnet. Is there a simple way to achieve this setup, like applying an optional label to a container and have it behind the tailnet?