Skip to main content
boxd can serve your organization over Tailscale. Once enabled, your machines keep every name they already have (myapp.boxd.sh, subdomain proxies like api.myapp.boxd.sh, and your org’s wildcard domain) and the same TLS certificates. What changes is who can reach them. Those names now resolve and route only inside your tailnet. This is enforced at boxd’s edge, well beyond hiding a DNS record. Someone who knows the public IP and your machine’s name gets the same 404 a nonexistent machine gets. HTTPS, SSH, and exposed raw ports all move onto the tailnet together. Management stays where it was. The CLI, console, SDKs, and boxd connect go through the boxd API, so they keep working from anywhere. It’s traffic to your machines that needs the tailnet.

​
Set it up

Tailscale runs per organization and the boxd team enables it together with you, so start by reaching out.
1

Reach out with an auth key

Send your org name and an auth key to contact@boxd.sh, or drop them in your shared Slack channel with us. Generate the key in the Tailscale admin console with Reusable on, Ephemeral off, and Tags empty. Reusable matters because boxd enrols one device per edge server. We enable Tailscale for the org and store the key encrypted, so edge servers added later can enrol with it too.
2

Approve the devices

boxd’s edge servers appear in your tailnet as devices named boxd-proxy-*. If you use ACLs, allow your users to reach them on all ports. Then disable key expiry on each device, because Tailscale expires untagged devices after 180 days and your org’s access would stop with nothing pointing at the cause.
3

Connect

Join the tailnet on your laptop and use your machines exactly as before:
Off the tailnet, the names stop resolving.

​
What to know

  • Everyone needs to be on the tailnet. DNS for your machines answers with the tailnet address only, so org members outside the tailnet lose access to the hostnames. That is the point, but tell your team before flipping it on.
  • Custom domains: org-wide only. Your org’s wildcard domain follows the tailnet, because boxd serves its DNS. A per-machine domain can’t follow, because its apex A record lives in your own DNS zone pointing at boxd’s public IP. boxd machine domain add refuses the combination and names the conflict.
  • Auth keys expire after 90 days at most. That only matters when boxd adds edge capacity, since an expired key means a new edge server can’t enrol in your tailnet. If a machine ever stops being reachable over the tailnet, mint a fresh key and send it over. Enabling again replaces the stored key.
  • Turning it off. Ask us to disable it. Your machines return to the public path, and boxd’s devices log out of your tailnet.
If machine names resolve on one network and fail on another, check the local resolver. Some corporate and router DNS setups strip answers in Tailscale’s 100.64.0.0/10 range as DNS-rebinding protection. Point your device at a resolver that keeps them, or use Tailscale’s own DNS.