> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vulpy.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Tailscale and the Fox sidecar identity

> How Fox joins its own Tailscale identity via a sidecar, keeps SSH separate from Fox, and serves HTTPS on its MagicDNS name in the tailnet.

Vulpy separates two Tailscale identities so SSH and Fox stay on distinct devices in your tailnet. Fox joins via a sidecar container defined in `docker-compose.hermes.yml`. The host joins on its own if you opt in during install. This separation means Fox actions are logged as a distinct device, and you can revoke Fox from Tailscale without losing SSH access to the server.

<Tip>
  **Ask Fox about its own Tailscale state.** Fox knows whether its sidecar is up and what MagicDNS name it's on.

  Try prompts like:

  * "Is the Fox Tailscale sidecar healthy?"
  * "What's my Fox MagicDNS name?"
  * "Run `pnpm vulpy hermes doctor` and summarize."
</Tip>

## Two identities, on purpose

### Fox identity

The Fox container runs a Tailscale sidecar inside `docker-compose.hermes.yml`. This sidecar creates a device in your tailnet named for the Fox instance. When you choose Tailscale-only access at install, Fox serves the WebUI over HTTPS on ports 443 and 80 using its MagicDNS name. You do not need a public domain or TLS certificate from an external provider.

### Host identity

The host Tailscale install is a standard Tailscale daemon on the VPS. It is used for SSH and human day-2 operations. It is separate from the Fox sidecar and can be enabled or disabled independently.

### Why separate them

* **Auditability**: Fox actions appear as a distinct device in your tailnet logs.
* **Revocation**: You can remove the Fox device from Tailscale without disconnecting your own SSH session.
* **Least privilege**: Fox has no access to host-level Tailscale features like SSH key management.

## Access modes at install

During install you choose how Fox and the storefront are exposed. The four modes are covered in detail on the [production deploy](/deploy/production) page:

* **Tailscale** (default): Fox serves HTTPS on its MagicDNS name. No public domain needed.
* **Own domain**: You provide domains for the shop, API, and preview.
* **No domain**: Uses sslip.io for local or test setups.
* **Both**: Tailscale and public domain coexist.

If you select Tailscale or Both, the install wizard asks for a Tailscale auth key for the Fox sidecar.

## Getting a Fox auth key

1. Open the [Tailscale admin console](https://login.tailscale.com/admin) and go to **Settings → Keys**.
2. Generate a **reusable, tagged** auth key. Tag it for the Fox device so ACLs can target it separately from your human nodes.
3. Copy the key and paste it into the Vulpy install wizard when prompted.
4. Do not reuse the host auth key. Fox needs its own key so it appears as a separate device.

<Note>
  If you are installing non-interactively, set the auth key via the documented env var path in your install flow. The install wizard stores it for the Hermes stack.
</Note>

## Verify

After the Hermes stack is running, confirm the Fox sidecar is connected:

```bash title="Terminal" theme={null}
pnpm vulpy hermes doctor
```

The doctor output reports the Fox sidecar Tailscale status. If it shows connected, open the Fox MagicDNS name in your browser to reach the WebUI on HTTPS.

<Warning>
  Rotating the Fox auth key requires restarting the Hermes stack. Run `pnpm vulpy hermes down` followed by `pnpm vulpy hermes up` after updating the key.
</Warning>

## What Fox can and can't do inside the tailnet

Fox has no Docker socket. It cannot create, delete, or modify Docker Compose environments. It runs environment actions (pull-data, logs, push-staging) only when you approve them in the WebUI. See [Environment context](/fox/environment-context) for how Fox interacts with dev, staging, and live environments.

Because Fox is isolated, it cannot escalate from the tailnet into host infrastructure. Its reach is limited to the services you expose and the actions you authorize.

## Reference

For more on auth keys, ACL tags, and MagicDNS, see the [Tailscale documentation](https://tailscale.com/kb).

<CardGroup cols={2}>
  <Card title="Production deploy" icon="server" href="/deploy/production">
    Choose an access mode and configure domains for live environments.
  </Card>

  <Card title="IMDS lock" icon="lock" href="/fox/imds-lock">
    Learn how Vulpy blocks EC2 IMDS inside the Fox container and when to opt out.
  </Card>
</CardGroup>