[Bug]: Docker Health Check fails in combination with Tailscale #2379

New Issue

GiteaMirror · 2026-02-28T20:12:19-06:00

GiteaMirror commented

2026-02-28 20:12:19 -06:00

Originally created by @diktomat on GitHub (Aug 11, 2025).

Verified issue does not already exist?

I have searched and found no existing issue

What happened?

When using Actual inside Docker, and using Tailscale to get access, either the Docker healthcheck or the listening will fail.

How can we reproduce the issue?

docker-compose.yml:

services:
  actual_server:
    image: docker.io/actualbudget/actual-server:latest-alpine
    ports:
      - '5006:5006'
    extra_hosts:
      - 'pi.tailXXXX.ts.net=::1'
    environment:
      - ACTUAL_HTTPS_KEY=/certs/pi.tailXXXX.ts.net.key
      - ACTUAL_HTTPS_CERT=/certs/pi.tailXXXX.ts.net.crt
      - ACTUAL_HOSTNAME=pi.tailXXXX.ts.net
      - ACTUAL_PORT=5006
    volumes:
      - ./actual:/data
      - ./certs:/certs
    healthcheck:
      test: ['CMD-SHELL', 'node src/scripts/health-check.js']
      interval: 60s
      timeout: 10s
      retries: 3
      start_period: 20s
    restart: unless-stopped

Like this the health check passes, but it will refuse all connections. If one removes the ACTUAL_HOSTNAME variable, it will serve flawlessly, but the healthcheck fails, as the certificate is not for localhost:

Health check failed: FetchError: request to https://localhost:5006/health failed, reason: Hostname/IP does not match certificate's altnames: Host: localhost. is not in the cert's altnames: DNS:pi.tailXXXX.ts.net at ClientRequest.<anonymous> (/app/node_modules/node-fetch/lib/index.js:1501:11) at ClientRequest.emit (node:events:517:28) at TLSSocket.socketErrorListener (node:_http_client:501:9) at TLSSocket.emit (node:events:517:28) at emitErrorNT (node:internal/streams/destroy:151:8) at emitErrorCloseNT (node:internal/streams/destroy:116:3) at process.processTicksAndRejections (node:internal/process/task_queues:82:21) { type: 'system', errno: 'ERR_TLS_CERT_ALTNAME_INVALID', code: 'ERR_TLS_CERT_ALTNAME_INVALID' }

Where are you hosting Actual?

NAS

What browsers are you seeing the problem on?

Other

Operating System

Linux

Originally created by @diktomat on GitHub (Aug 11, 2025). ### Verified issue does not already exist? - [x] I have searched and found no existing issue ### What happened? When using Actual inside Docker, and using Tailscale to get access, either the Docker healthcheck or the listening will fail. ### How can we reproduce the issue? docker-compose.yml: ```yaml services: actual_server: image: docker.io/actualbudget/actual-server:latest-alpine ports: - '5006:5006' extra_hosts: - 'pi.tailXXXX.ts.net=::1' environment: - ACTUAL_HTTPS_KEY=/certs/pi.tailXXXX.ts.net.key - ACTUAL_HTTPS_CERT=/certs/pi.tailXXXX.ts.net.crt - ACTUAL_HOSTNAME=pi.tailXXXX.ts.net - ACTUAL_PORT=5006 volumes: - ./actual:/data - ./certs:/certs healthcheck: test: ['CMD-SHELL', 'node src/scripts/health-check.js'] interval: 60s timeout: 10s retries: 3 start_period: 20s restart: unless-stopped ``` Like this the health check passes, but it will refuse all connections. If one removes the `ACTUAL_HOSTNAME` variable, it will serve flawlessly, but the healthcheck fails, as the certificate is not for localhost: ``` Health check failed: FetchError: request to https://localhost:5006/health failed, reason: Hostname/IP does not match certificate's altnames: Host: localhost. is not in the cert's altnames: DNS:pi.tailXXXX.ts.net at ClientRequest.<anonymous> (/app/node_modules/node-fetch/lib/index.js:1501:11) at ClientRequest.emit (node:events:517:28) at TLSSocket.socketErrorListener (node:_http_client:501:9) at TLSSocket.emit (node:events:517:28) at emitErrorNT (node:internal/streams/destroy:151:8) at emitErrorCloseNT (node:internal/streams/destroy:116:3) at process.processTicksAndRejections (node:internal/process/task_queues:82:21) { type: 'system', errno: 'ERR_TLS_CERT_ALTNAME_INVALID', code: 'ERR_TLS_CERT_ALTNAME_INVALID' } ``` ### Where are you hosting Actual? NAS ### What browsers are you seeing the problem on? Other ### Operating System Linux

GiteaMirror closed this issue

2026-02-28 20:12:19 -06:00

GiteaMirror commented

2026-02-28 20:12:20 -06:00

@MatissJanis commented on GitHub (Aug 11, 2025):

👋 Hi!
Please use the community discord for tech support. Tailscale is not an officially supported solution for Actual, but I'm sure someone on the community Discord is using it too and will be able to assist.

We use github issues only for feature requests and bug reports. Since this is neither - closing.

@MatissJanis commented on GitHub (Aug 11, 2025): 👋 Hi! Please use the community discord for tech support. Tailscale is not an officially supported solution for Actual, but I'm sure someone on the community Discord is using it too and will be able to assist. We use github issues only for feature requests and bug reports. Since this is neither - closing.