> ## Documentation Index
> Fetch the complete documentation index at: https://docs.boxd.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Tailscale

> Serve your whole org over your company tailnet. Same hostnames, same TLS, reachable only from inside your Tailscale network.

boxd can serve your organization over [Tailscale](https://tailscale.com). Once enabled, your machines keep every name they already have (`myapp.boxd.sh`, subdomain proxies like `api.myapp.boxd.sh`, and your org's [wildcard domain](/guides/custom-domains#org-wide-wildcard-domain)) and the same TLS certificates. What changes is who can reach them. Those names now resolve and route only inside your tailnet.

This is enforced at boxd's edge, well beyond hiding a DNS record. Someone who knows the public IP and your machine's name gets the same 404 a nonexistent machine gets. HTTPS, SSH, and [exposed raw ports](/guides/port-forwarding) all move onto the tailnet together.

Management stays where it was. The CLI, console, SDKs, and `boxd connect` go through the boxd API, so they keep working from anywhere. It's traffic **to your machines** that needs the tailnet.

## Set it up

Tailscale runs per organization and the boxd team enables it together with you, so start by reaching out.

<Steps>
  <Step title="Reach out with an auth key">
    Send your org name and an auth key to [contact@boxd.sh](mailto:contact@boxd.sh), or drop them in your shared Slack channel with us. Generate the key in the [Tailscale admin console](https://login.tailscale.com/admin/settings/keys) with **Reusable** on, **Ephemeral** off, and **Tags** empty. Reusable matters because boxd enrols one device per edge server. We enable Tailscale for the org and store the key encrypted, so edge servers added later can enrol with it too.
  </Step>

  <Step title="Approve the devices">
    boxd's edge servers appear in your tailnet as devices named `boxd-proxy-*`. If you use ACLs, allow your users to reach them on all ports. Then **disable key expiry** on each device, because Tailscale expires untagged devices after 180 days and your org's access would stop with nothing pointing at the cause.
  </Step>

  <Step title="Connect">
    Join the tailnet on your laptop and use your machines exactly as before:

    ```bash theme={"theme":"github-dark"}
    curl https://myapp.boxd.sh    # HTTPS, same certificate
    ssh myapp.boxd                # the managed SSH alias keeps working
    ```

    Off the tailnet, the names stop resolving.
  </Step>
</Steps>

## What to know

* **Everyone needs to be on the tailnet.** DNS for your machines answers with the tailnet address only, so org members outside the tailnet lose access to the hostnames. That is the point, but tell your team before flipping it on.
* **Custom domains: org-wide only.** Your org's [wildcard domain](/guides/custom-domains#org-wide-wildcard-domain) follows the tailnet, because boxd serves its DNS. A [per-machine domain](/guides/custom-domains#per-machine) can't follow, because its apex A record lives in your own DNS zone pointing at boxd's public IP. `boxd machine domain add` refuses the combination and names the conflict.
* **Auth keys expire after 90 days at most.** That only matters when boxd adds edge capacity, since an expired key means a new edge server can't enrol in your tailnet. If a machine ever stops being reachable over the tailnet, mint a fresh key and send it over. Enabling again replaces the stored key.
* **Turning it off.** Ask us to disable it. Your machines return to the public path, and boxd's devices log out of your tailnet.

<Note>
  If machine names resolve on one network and fail on another, check the local resolver. Some corporate and router DNS setups strip answers in Tailscale's `100.64.0.0/10` range as DNS-rebinding protection. Point your device at a resolver that keeps them, or use Tailscale's own DNS.
</Note>