Home lab first

1. Run the serverCopy Anchor Link

Create a Tailscale auth key for the server. On your Docker host, run:

docker run -d --name envden --restart unless-stopped \
  -e TS_AUTHKEY="tskey-auth-..." \
  -v envden-data:/data \
  -v tailscale-state:/var/lib/tailscale \
  ghcr.io/notsuhas/envden:0.1.0

Replace tskey-auth-... with your auth key. The volumes keep envden data and Tailscale state across container replacements. The container joins your tailnet as envden; set TS_HOSTNAME to choose another name.

The container uses userspace Tailscale. You don't need privileged mode, a TUN device or a published host port. tailscale serve exposes the localhost server over HTTPS.

Read the setup token:

docker logs envden

Keep the token for the next step. It includes the server key's fingerprint so your laptop can verify the server before creating a vault.

2. Set up your first deviceCopy Anchor Link

Install the CLI on your laptop. Use the server's full Tailscale HTTPS address:

envden setup --server https://envden.your-tailnet.ts.net

Replace the example hostname with yours. In your terminal, enter the setup token, name this device and choose a master password.

Setup prints a recovery kit. Store it somewhere you can recover without this laptop. You can write it directly to a private file with --kit-out /path/to/kit.json. A kit with the master password written on it gives full access to the vault.

Setup also asks about telemetry, update checks, the shell notice and the agent skill. It scans your home folder for repos, asks you to approve checkouts, places their env files and pushes them.

To scan a smaller folder:

envden setup --server https://envden.your-tailnet.ts.net --scan-root ~/Work

Each checkout needs approval, including each worktree of a repo you've already approved. --yes doesn't skip approval. macOS may ask for folder access during the scan.

3. Add another machineCopy Anchor Link

Join your other devices with a pairing code or your recovery kit.