jackspiering · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026 · Oct 15, 2026
@@ -181,6 +181,7 @@ Every stack starts from the same [standard setup](documentation/standard-setup.m
 | **SubTrackr**     | Subscription tracker that shows monthly and yearly costs and when each one renews.         | [Details](services/subtrackr)     |
 | **Sure**          | Fork of the archived Maybe finance app, for tracking accounts, investments, and net worth. | [Details](services/sure)          |
 | **Vikunja**       | To-do and project management app with lists, boards, Gantt charts, and reminders.          | [Details](services/vikunja)       |
+| **Wallabag**      | Read-it-later app that saves web pages as articles.                                        | [Details](services/wallabag)      |
 | **Wallos**        | Subscription and expense tracker with payment reminders and budget help.                   | [Details](services/wallos)        |
 | **XWiki**         | Wiki platform for documentation and knowledge management, with extensions.                 | [Details](services/xwiki)         |
 

@@ -0,0 +1,32 @@
+#URL=https://github.com/tailscale-dev/ScaleTail
+# To run a second copy, copy the folder under another name and change SERVICE.
+
+# Service Configuration
+# Service name (e.g., adguard). Used as hostname in Tailscale and for container naming.
+SERVICE=wallabag
+# Docker image URL from container registry (e.g., adguard/adguardhome:latest).
+IMAGE_URL=wallabag/wallabag:2.6.14
+
+# Network Configuration
+# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable.
+SERVICEPORT=80
+# Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable.
+DNS_SERVER=9.9.9.9
+
+# Tailscale Configuration
+# Auth key from https://console.tailscale.com/admin/settings/keys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions.
+TS_AUTHKEY=
+
+# Time Zone setting for containers. See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
+TZ=Europe/Amsterdam
+
+# Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/
+
+# Required: your Tailnet name, the part between the service name and ".ts.net" in https://wallabag.<tailnet name>.ts.net, for example tail1234.
+TAILNET_NAME=
+# Required: signs the sessions and tokens. Generate it with: openssl rand -hex 32
+WALLABAG_SECRET=
+# Required: password of the wallabag database user. Generate it with: openssl rand -hex 32
+DATABASE_PASSWORD=
+# Required: password of the database root user. Generate it with: openssl rand -hex 32
+MYSQL_ROOT_PASSWORD=
@@ -0,0 +1,54 @@
+# Wallabag
+
+[Wallabag](https://wallabag.org/) is a read-it-later app. It saves web pages as clean articles that you can tag, annotate, and read later, from the web interface, the mobile apps, or a browser extension.
+
+This stack runs Wallabag with a Tailscale sidecar, as described in [the standard setup](../../documentation/standard-setup.md).
+
+## At a glance
+
+| Item          | Value                                       |
+| ------------- | ------------------------------------------- |
+| Web interface | `https://wallabag.<tailnet>.ts.net`         |
+| Service port  | `80`                                        |
+| Images        | `wallabag/wallabag`                         |
+|               | `mariadb:11.8`                              |
+| Data          | `./wallabag-data/db` (MariaDB database)     |
+|               | `./wallabag-data/images` (article pictures) |
+
+## Before you start
+
+Set these values in `.env`. Compose stops with an error if one of them is empty.
+
+- **`TAILNET_NAME`.** Your Tailnet name, the part between the service name and `.ts.net`, for example `tail1234`. `compose.yaml` builds the address `https://<SERVICE>.<TAILNET_NAME>.ts.net` from it.
+- **`WALLABAG_SECRET`.** Signs sessions and tokens. Generate one with `openssl rand -hex 32`. Without it, the image falls back to a fixed secret that is public.
+- **`DATABASE_PASSWORD`.** The password of the `wallabag` database user. Generate one with `openssl rand -hex 32`. MariaDB applies it only when it first creates the database.
+- **`MYSQL_ROOT_PASSWORD`.** The password of the database root user. Generate one with `openssl rand -hex 32`. MariaDB applies it only when it first creates the database. Wallabag uses it on the first start to create its database and user.
+
+Create the folder for article pictures before the first start, and give it to the user that runs Wallabag inside the container, `nobody` with the ID `65534`. Docker would otherwise create it as `root`, and Wallabag could not save pictures there when you turn on "Download images locally" in the Misc section of the internal settings:
+
+```sh
+mkdir -p wallabag-data/images
+sudo chown 65534:65534 wallabag-data/images
+```
+
+## Deviations from the standard setup
+
+- **Extra container.** The stack runs a `db` container with MariaDB. Wallabag reaches it by its Compose service name over the Docker network, and it is not reachable from your Tailnet.
+- **No Redis.** The upstream Compose example adds Redis, which Wallabag uses only for asynchronous imports, and only with a separate import worker. Wallabag imports without it, so this stack leaves both out. Keep "Enable Redis to import data asynchronously" and "Enable RabbitMQ to import data asynchronously" off in the Import section of the internal settings.
+- **Base address.** `SYMFONY__ENV__DOMAIN_NAME` in `compose.yaml` is the Tailnet address of the service. Wallabag uses it for the links it generates. If you change `SERVICE` or `TAILNET_NAME`, the address changes with them.
+
+## First run
+
+Open the web interface and log in with the default account: user `wallabag`, password `wallabag`. Change the password right away on the Config page: until you do, anyone on your Tailnet can log in. After the first login, Wallabag shows a quickstart page.
+
+To add an article, paste its address into the add field at the top of the page. The browser extensions and the mobile apps connect to `https://wallabag.<tailnet>.ts.net`, and the device must be connected to your Tailnet. The [Wallabag documentation](https://doc.wallabag.org/) explains how to create the API client they need.
+
+## Troubleshooting
+
+- **`WARN: MySQL database is already configured` in the logs.** The Wallabag container found its database on a later start. The message is harmless: the entrypoint creates the database only once.
+
+## Links
+
+- [Wallabag documentation](https://doc.wallabag.org/)
+- [Wallabag Docker image and Compose example](https://github.com/wallabag/docker)
+- [Wallabag source code](https://github.com/wallabag/wallabag)
@@ -0,0 +1,92 @@
+configs:
+  ts-serve:
+    content: |
+      {"TCP":{"443":{"HTTPS":true}},
+      "Web":{"$${TS_CERT_DOMAIN}:443":
+          {"Handlers":{"/":
+          {"Proxy":"http://127.0.0.1:80"}}}},
+      "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}}
+
+services:
+# Make sure you have updated/checked the .env file with the correct variables.
+# Every variable used in this file must be defined there, unless it has a default such as ${VAR:-value}.
+  # Tailscale Sidecar Configuration
+  tailscale:
+    image: tailscale/tailscale:latest # Image to be used
+    container_name: tailscale-${SERVICE} # Name for local container management
+    hostname: ${SERVICE} # Name used within your Tailscale environment
+    environment:
+      - TS_AUTHKEY=${TS_AUTHKEY}
+      - TS_STATE_DIR=/var/lib/tailscale
+      - TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required
+      - TS_USERSPACE=false
+      - TS_ENABLE_HEALTH_CHECK=true              # Enable healthcheck endpoint: "/healthz"
+      - TS_LOCAL_ADDR_PORT=127.0.0.1:41234       # The <addr>:<port> for the healthz endpoint
+      #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve
+      - TS_AUTH_ONCE=true
+    configs:
+      - source: ts-serve
+        target: /config/serve.json
+    volumes:
+      - ./config:/config # Config folder used to store Tailscale files - you may need to change the path
+      - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path
+    devices:
+      - /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work
+    cap_add:
+      - net_admin # Tailscale requirement
+    #ports:
+    #  - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required
+    # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below
+    #dns:
+    #  - ${DNS_SERVER}
+    healthcheck:
+      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational
+      interval: 1m # How often to perform the check
+      timeout: 10s # Time to wait for the check to succeed
+      retries: 3 # Number of retries before marking as unhealthy
+      start_period: 10s # Time to wait before starting health checks
+    restart: always
+
+  # Application
+  application:
+    image: ${IMAGE_URL} # Image to be used
+    network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale
+    container_name: app-${SERVICE} # Name for local container management
+    environment: # Variables are declared in .env file.
+      - TZ=${TZ}
+      - SYMFONY__ENV__DOMAIN_NAME=https://${SERVICE}.${TAILNET_NAME:?Set TAILNET_NAME in .env}.ts.net
+      - SYMFONY__ENV__SECRET=${WALLABAG_SECRET:?Set WALLABAG_SECRET in .env}
+      - SYMFONY__ENV__DATABASE_DRIVER=pdo_mysql
+      - SYMFONY__ENV__DATABASE_HOST=db
+      - SYMFONY__ENV__DATABASE_PORT=3306
+      - SYMFONY__ENV__DATABASE_NAME=wallabag
+      - SYMFONY__ENV__DATABASE_USER=wallabag
+      - SYMFONY__ENV__DATABASE_PASSWORD=${DATABASE_PASSWORD:?Set DATABASE_PASSWORD in .env}
+      - SYMFONY__ENV__DATABASE_CHARSET=utf8mb4
+      # The entrypoint uses the root password to create the database and the user on the first start.
+      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD:?Set MYSQL_ROOT_PASSWORD in .env}
+    volumes:
+      - ./${SERVICE}-data/images:/var/www/wallabag/web/assets/images
+    depends_on:
+      tailscale:
+        condition: service_healthy
+      db:
+        condition: service_healthy
+    # Healthcheck: defined by the image (curl on http://localhost/api/info), so this file does not override it.
+    restart: always
+
+  # Database
+  db:
+    image: mariadb:11.8
+    container_name: app-${SERVICE}-db # Name for local container management
+    environment:
+      - MARIADB_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD:?Set MYSQL_ROOT_PASSWORD in .env}
+    volumes:
+      - ./${SERVICE}-data/db:/var/lib/mysql
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"] # Check if MariaDB accepts connections and InnoDB is initialized
+      interval: 10s # How often to perform the check
+      timeout: 5s # Time to wait for the check to succeed
+      retries: 5 # Number of retries before marking as unhealthy
+      start_period: 30s # Time to wait before starting health checks
+    restart: always