- ts-outline-sync sidecar joins Tailscale and shares network namespace
with the app container (network_mode: service:ts-*)
- Traefik labels on sidecar; app container has no direct network exposure
- OUTLINE_URL now uses internal Docker IP 172.29.0.7:3000 via Tailscale
subnet route (domverse.de advertises 172.29.0.0/16)
- Add TAILSCALE_PRD.md documenting the full setup and admin checklist
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>