Windows OpenCloud Server with Tailscale

I tried to build my own cloud server at home, but without dedicated hardware I had to run it on my personal computer. Even though I eventually got everything working after many hours, I ended up scrapping the whole setup and going back to SyncThing. The deal-breaker was my Obsidian notes, the Obsidian mobile app does not let you pick cloud folders, so I couldn’t access my files on my phone.

I’m still putting this guide together as there’s not much out there about installing OpenCloud on Windows or hooking it up to Tailscale, maybe it’ll save someone else the time I had spent troubleshooting.

Tailscale

Open up your Tailscale Admin console.

Firstly, make sure that your machines have tags assigned to them already as Tailscale’s services functionality will only accept hosts that have been assigned tags.

This can be done by clicking the dots beside the machine, and pressing Edit ACL tags

Afterwards, navigate to Services

Define a new service

Add the port 443 (Or whatever port you’re planning to run the OpenCloud server on)

Then on the device that is running the OpenCloud server, ensure Tailscale is already installed, then run this in the cmd:

tailscale serve --service=svc:SERVICENAME--https=443 https+insecure://localhost:443

To check your configurations:

tailscale serve status --json

Go back to the Tailscale Admin Console and under Services, check if there is a new machine added that needs approval.

Click on Approve.

Clone OpenCloud repository

Clone the OpenCloud repository with this command:

git clone https://github.com/opencloud-eu/opencloud-compose.git

.env Configuration

After cloning the OpenCloud repository, create make a copy of .env.example. and rename it as .env

The following settings are to be changed:

• INSECURE
  • Set to true if self-signed certificates are to be used
• COMPOSE_FILE
  • Change depending on which additional functionalities you want
  • Traefik is a reverse proxy to allow users to connect to the OpenCloud server. If you’re planning to run your own reverse proxy server, you don’t need this.
  • Collabora is a browser-based office suite that allows real-time editing of the files on the OpenCloud server. Can remove if you’re not keen on this functionality.
• TRAEFIK_DOMAIN
  • If Traefik is to be used
  • Set it to your Tailnet DNS name (Found under Tailscale Admin Console, DNS settings)
  • E.g traefik.xxxx.ts.net
• TRAEFIK_SERVICES_TLS_CONFIG
  • If Traefik is to be used
  • Change accordingly if self-signed certificates are to be used
• TRAEFIK_CERTS_DIR
  • If Traefik is to be used
  • Change accordingly depending on where you want to store your certificates
• OC_DOMAIN
  • Must be changed
  • Set it to your Tailnet DNS name (Found under Tailscale Admin Console, DNS settings)
  • E.g cloud.xxxx.ts.net
• INITIAL_ADMIN_PASSWORD
  • Must be changed
  • Set it to something like SUPERSAFEPASSWORD
  • The admin password is to be changed immediately after logging in to the OpenCloud server
• LOG_LEVEL
  • Set accordingly if you only want certain logs
• LOG_PRETTY
  • Set to true for the logs to be more human-readable
• COLLABORA SETTINGS
  • If not using Collabora, comment out everything under it as it’ll create error logs if not using them.

Depending on your preferences, change the above settings accordingly.

The below configuration is my personal .env file, where I am planning to use my own self-signed certificates, where the certificates are to be stored at /certs, and I will only be using Traefik and not Collabora.

## Basic Settings ##
# Define the docker compose log driver used.
# Defaults to local
LOG_DRIVER=
# If you're on an internet facing server, comment out following line.
# It skips certificate validation for various parts of OpenCloud and is
# needed when self signed certificates are used.
INSECURE=true

## Features ##
# The following variable is a convenience variable to enable or disable features of this compose project.
# Example: if you want to use traefik and letsencrypt, you can set the variable to
COMPOSE_FILE=docker-compose.yml:traefik/opencloud.yml
# This enables you to just run `docker compose up -d` and the compose files will be added to the stack.
# As alternative approach you can run `docker compose -f docker-compose.yml -f docker-compose.traefik.yml up -d`
# Default: OpenCloud and Collabora with traefik and letsencypt
# This needs DNS entries for the domain names used in the .env file.
#COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:traefik/opencloud.yml:traefik/collabora.yml
# If you want to use the external proxy, you can use the following combination.
# DNS entries and certificates need to be managed by the external environment.
# The domain names need to be entered into the .env file.
#COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:external-proxy/opencloud.yml:external-proxy/collabora.yml
# Keycloak Shared User Directory
#COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:traefik/opencloud.yml:traefik/collabora.yml:idm/ldap-keycloak.yml:traefik/ldap-keycloak.yml
# External IDP
#COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:traefik/opencloud.yml:traefik/collabora.yml:idm/external-idp.yml

## Traefik Settings ##
# Note: Traefik is always enabled and can't be disabled.
# Serve Traefik dashboard.
# Defaults to "false".
TRAEFIK_DASHBOARD=
# Domain of Traefik, where you can find the dashboard.
# Defaults to "traefik.opencloud.test"
TRAEFIK_DOMAIN= traefik.xxx.ts.net
# Basic authentication for the traefik dashboard.
# Defaults to user "admin" and password "admin" (written as: "admin:$2y$05$KDHu3xq92SPaO3G8Ybkc7edd51pPLJcG1nWk3lmlrIdANQ/B6r5pq").
# To create user:password pair, it's possible to use this command:
# echo $(htpasswd -nB user) | sed -e s/\\$/\\$\\$/g
TRAEFIK_BASIC_AUTH_USERS=
# Email address for obtaining LetsEncrypt certificates.
# Needs only be changed if this is a public facing server.
TRAEFIK_ACME_MAIL=
# Set to the following for testing to check the certificate process:
# "https://acme-staging-v02.api.letsencrypt.org/directory"
# With staging configured, there will be an SSL error in the browser.
# When certificates are displayed and are emitted by # "Fake LE Intermediate X1",
# the process went well and the envvar can be reset to empty to get valid certificates.
TRAEFIK_ACME_CASERVER=
# Enable the Traefik ACME (Automatic Certificate Management Environment) for automatic SSL certificate management.
# TRAEFIK_SERVICES_TLS_CONFIG="tls.certresolver=letsencrypt"
# Enable Traefik to use local certificates.
TRAEFIK_SERVICES_TLS_CONFIG="tls=true"
# You also need to provide a config file in ./config/traefik/dynamic/certs.yml
# Example:
# cat ./config/traefik/dynamic/certs.yml
# tls:
#   certificates:
#     - certFile: /certs/opencloud.test.crt
#       keyFile: /certs/opencloud.test.key
#   stores:
#     - default
#
# The certificates need to be copied into ./certs/, the absolute path inside the container is /certs/.
# You can also use TRAEFIK_CERTS_DIR=/path/on/host to set the path to the certificates directory.
TRAEFIK_CERTS_DIR=./certs
# Enable the access log for Traefik by setting the following variable to true.
TRAEFIK_ACCESS_LOG=
# Configure the log level for Traefik.
# Possible values are "TRACE", "DEBUG", "INFO", "WARN", "ERROR", "FATAL" and "PANIC". Default is "ERROR".
TRAEFIK_LOG_LEVEL=warn
# The default for traefik is to run in privileged mode.
# If you want to run traefik non-privileged, use the following variable and the format [UID]:[GID] to set user and group of your choice.
# Ensure that the user has access to docker.sock and traefik volumes defined in traefik/opencloud.yml
#TRAEFIK_CONTAINER_UID_GID="1000:1000"
# Configure ports for HTTP and HTTPS when necessary, defaults are 80 and 443
# Don't use ports in the range of 8000-9999 and 5232 as those ports are used internally and therefore might create conflicts.
#TRAEFIK_PORT_HTTP=4080
#TRAEFIK_PORT_HTTPS=4443

## OpenCloud Settings ##
# The opencloud container image.
# For production releases: "opencloudeu/opencloud"
# For rolling releases:    "opencloudeu/opencloud-rolling"
# Defaults to production if not set otherwise
OC_DOCKER_IMAGE=opencloudeu/opencloud-rolling
# The openCloud container version.
# Defaults to the latest version-tag. Use git pull to update.
OC_DOCKER_TAG=
# The default id used in opencloud containers is 1000 for user and group.
# If you want to change the default, use the following variable and the format [UID]:[GID].
# The change affects all containers with access to data volumes.
# Ensure that the user has access to all volumes defined in docker-compose.yml
#OC_CONTAINER_UID_GID="1000:1000"
# Domain of openCloud, where you can find the frontend.
# Defaults to "cloud.opencloud.test"
OC_DOMAIN= cloud.xxx.ts.net
# Demo users should not be created on a production instance,
# because their passwords are public. Defaults to "false".
# If demo users is set to "true", the following user accounts are created automatically:
# alan, mary, margaret, dennis and lynn - the password is 'demo' for all.
DEMO_USERS=
# Admin Password for the OpenCloud admin user.
# NOTE: This is only needed when using the built-in LDAP server (idm).
# If you are using an external LDAP server, the admin password is managed by the LDAP server.
# NOTE: This variable needs to be set before the first start of OpenCloud. Changes to this variable after the first start will be IGNORED.
# If not set, opencloud will not work properly. The container will be restarting.
# After the first initialization, the admin password can only be changed via the OpenCloud User Settings UI or by using the OpenCloud CLI.
# Documentation: https://docs.opencloud.eu/docs/admin/resources/common-issues#-change-admin-password-set-in-env
INITIAL_ADMIN_PASSWORD=SUPERSAFEPASSWORD
# Whether clients should check for updates.
# Defaults to "true".
CHECK_FOR_UPDATES=
# Define the openCloud loglevel used.
#
LOG_LEVEL=warn
# Define the kind of logging.
# The default log can be read by machines.
# Set this to true to make the log human readable.
#LOG_PRETTY=true
#
# Define the openCloud storage location. Set the paths for config and data to a local path.
# Ensure that the configuration and data directories are owned by the user and group with ID 1000:1000.
# This matches the default user inside the container and avoids permission issues when accessing files.
# Note that especially the data directory can grow big.
# Leaving it default stores data in docker internal volumes.
OC_CONFIG_DIR=
OC_DATA_DIR=
# OpenCloud Web can load extensions from a local directory.
# The default uses the bind mount to the config/opencloud/apps directory.
# Example: curl -L https://github.com/opencloud-eu/web-extensions/releases/download/unzip-v1.0.2/unzip-1.0.2.zip -o config/opencloud/apps/unzip-1.0.2.zip && unzip config/opencloud/apps/unzip-1.0.2.zip -d config/opencloud/apps && rm config/opencloud/apps/unzip-1.0.2.zip 
# NOTE: you need to restart the openCloud container to load the new extensions.
#OC_APPS_DIR=/your/local/opencloud/apps
#
# The default language used by services and the WebUI.
# Uses ISO 639-1 language codes (e.g. "en", "de", "fr").
# Defaults to English if not set.
DEFAULT_LANGUAGE=

# Define the ldap-server storage location. Set the paths for config and data to a local path.
# Leaving it default stores data in docker internal volumes.
LDAP_CERTS_DIR=
LDAP_DATA_DIR=

# S3 Storage configuration - optional
# OpenCloud supports S3 storage as primary storage.
# Per default, S3 storage is disabled and the decomposed storage driver is used.
# To enable S3 storage, add `storage/decomposeds3.yml` to the COMPOSE_FILE variable or to
# your startup command (`docker compose -f docker-compose.yml -f storage/decomposeds3.yml up`).
#
# Configure the S3 storage endpoint. Defaults to "http://minio:9000" for testing purposes.
DECOMPOSEDS3_ENDPOINT=
# S3 region. Defaults to "default".
DECOMPOSEDS3_REGION=
# S3 access key. Defaults to "opencloud"
DECOMPOSEDS3_ACCESS_KEY=
# S3 secret. Defaults to "opencloud-secret-key"
DECOMPOSEDS3_SECRET_KEY=
# S3 bucket. Defaults to "opencloud"
DECOMPOSEDS3_BUCKET=


# Define SMTP settings if you would like to send OpenCloud email notifications.
# To actually send notifications, you also need to enable the 'notifications' service
# by adding it to the START_ADDITIONAL_SERVICES variable below.
#
# NOTE: when configuring Inbucket, these settings have no effect, see inbucket.yml for details.
# SMTP host to connect to.
SMTP_HOST=
# Port of the SMTP host to connect to.
SMTP_PORT=
# An eMail address that is used for sending OpenCloud notification eMails
# like "opencloud notifications <noreply@yourdomain.com>".
SMTP_SENDER=
# Username for the SMTP host to connect to.
SMTP_USERNAME=
# Password for the SMTP host to connect to.
SMTP_PASSWORD=
# Authentication method for the SMTP communication.
SMTP_AUTHENTICATION=
# Encryption method for the SMTP communication. Possible values are 'starttls', 'ssltls' and 'none'
SMTP_TRANSPORT_ENCRYPTION=
# Allow insecure connections to the SMTP server. Defaults to false.
SMTP_INSECURE=

# Additional services to be started on opencloud startup
# The following list of services is not started automatically and must be
# manually defined for startup:
# IMPORTANT: Add any services to the startup list comma separated like "notifications,antivirus" etc.
START_ADDITIONAL_SERVICES=""


## Default Enabled Services ##

### Apache Tika Content Analysis Toolkit ###
# Tika (search) is disabled by default due to performance reasons.
# Tika is used to extract metadata and text from various file formats.
# Enable it by adding the following to the COMPOSE_FILE variable:
# search/tika.yml or by using the following command:
# docker compose -f docker-compose.yml -f search/tika.yml up -d
# Set the desired docker image tag or digest.
# Defaults to "apache/tika:latest"
# The slim variant is recommended for most use cases as it provides core text extraction
# functionality with a smaller image size and faster startup time.
# Only use the full variant (apache/tika:latest-full) if you need specialized features
# like advanced OCR or specific image processing capabilities.
TIKA_IMAGE=

### IMPORTANT Note for Online Office Apps ###
# To avoid app interlocking issues, you should select only one app to be active/configured.
# This is due the fact that there is currently no app interlocking for the same file and one
# has to wait for a lock release to open the file with another app.

### Collabora Settings ###
# Domain of Collabora, where you can find the frontend.
# Defaults to "collabora.opencloud.test"
# COLLABORA_DOMAIN=
# Domain of the wopiserver which handles Collabora.
# Defaults to "wopiserver.opencloud.test"
# WOPISERVER_DOMAIN=
# Admin user for Collabora.
# Defaults to "admin".
# Collabora Admin Panel URL:
# https://{COLLABORA_DOMAIN}/browser/dist/admin/admin.html
# COLLABORA_ADMIN_USER=
# Admin password for Collabora.
# Defaults to "admin".
# COLLABORA_ADMIN_PASSWORD=
# Set to true to enable SSL handling in Collabora Online, this is only required if you are not using a reverse proxy.
# Default is true if not specified.
# COLLABORA_SSL_ENABLE=false
# If you're on an internet-facing server, enable SSL verification for Collabora Online.
# Please comment out the following line:
# COLLABORA_SSL_VERIFICATION=false
# Enable home mode in Collabore Online.
# Home users can enable this setting, which in turn disables welcome screen and user feedback popups,
# but also limits concurrent open connections to 20 and concurrent open documents to 10.
# Default is false if not specified.
# COLLABORA_HOME_MODE=


### Virusscanner Settings ###
# IMPORTANT: If you enable antivirus, you also MUST configure the START_ADDITIONAL_SERVICES
# envvar in the OpenCloud Settings above by adding 'antivirus' to the list.
# The maximum scan size the virus scanner can handle, needs adjustment in the scanner config as well:
# For ClamAV, set CLAMD_CONF_StreamMaxLength in antivirus/clamav.yml to the same or a higher value.
# Usable common abbreviations: [KB, KiB, MB, MiB, GB, GiB, TB, TiB, PB, PiB, EB, EiB], example: 2GB.
# Defaults to "100MB"
#ANTIVIRUS_MAX_SCAN_SIZE=
# Usable modes: partial, skip.
# Defaults to "partial"
#ANTIVIRUS_MAX_SCAN_SIZE_MODE=
# Image version of the ClamAV container.
# Defaults to "latest"
CLAMAV_DOCKER_TAG=


### Inbucket Settings ###
# Inbucket is a mail catcher tool for testing purposes.
# DO NOT use in Production.
# email server (in this case inbucket acts as mail catcher).
# Domain for Inbucket. Defaults to "mail.opencloud.test".
INBUCKET_DOMAIN=


### Compose Configuration ###
# Path separator for supplemental compose files specified in COMPOSE_FILE.
COMPOSE_PATH_SEPARATOR=:

### Ldap Settings ###
# LDAP is always needed for OpenCloud to store user data as there is no relational database.
# The built-in LDAP server should used for testing purposes or small installations only.
# For production installations, it is recommended to use an external LDAP server.
# We are using OpenLDAP as the default LDAP server because it is proven to be stable and reliable.
# This LDAP configuration is known to work with OpenCloud and provides a blueprint for
# configuring an external LDAP server based on other products like Microsoft Active Directory or other LDAP servers.
#
# Password of LDAP bind user "cn=admin,dc=opencloud,dc=eu". Defaults to "admin"
LDAP_BIND_PASSWORD=SUPERSAFEPASSWORD
# The LDAP server also creates an openCloud admin user dn: uid=admin,ou=users,dc=opencloud,dc=eu
# The initial password for this user is "admin"
# NOTE: This password can only be set once, if you want to change it later, you have to use the OpenCloud User Settings UI.
# If you changed the password and lost it, you need to execute the following LDAP query to reset it:
# enter the ldap-server container with `docker compose exec ldap-server sh`
# and run the following command to change the password:
# ldappasswd -H ldap://127.0.0.1:1389 -D "cn=admin,dc=opencloud,dc=eu" -W "uid=admin,ou=users,dc=opencloud,dc=eu"
# You will be prompted for the LDAP bind password.
# The output should provide you a new password for the admin user.


### Keycloak Settings ###
# Keycloak is an open-source identity and access management solution.
# We are using Keycloak as the default identity provider on production installations.
# It can be used to federate authentication with other identity providers like
# Microsoft Entra ID, ADFS or other SAML/OIDC providers.
# The use of Keycloak as bridge between OpenCloud and other identity providers creates more control over the
# authentication process, the allowed clients and the session management.
# Keycloak also manages the Role Based Access Control (RBAC) for OpenCloud.
# Keycloak can be used in two different modes:
# 1. Autoprovisioning: New users are automatically created in openCloud when they log in for the first time.
# 2. Shared User Directory: Users are created in Keycloak and can be used in OpenCloud immediately
# because the LDAP server is connected to both Keycloak and OpenCloud.
# Only use one of the two modes at a time.

## Autoprovisioning Mode ##
# Use together with idm/external-idp.yml
# If you want to use a keycloak for local testing, you can use testing/external-keycloak.yml and testing/ldap-manager.yml
# Domain of your Identity Provider.
IDP_DOMAIN=
# IdP Issuer URL, which is used to identify the Identity Provider.
# We need the complete URL, including the protocol (http or https) and the realm.
# Example: "https://keycloak.opencloud.test/realms/openCloud"
IDP_ISSUER_URL=
# Url of the account edit page from your Identity Provider.
IDP_ACCOUNT_URL=

## Shared User Directory Mode ##
# Use together with idm/ldap-keycloak.yml and traefik/ldap-keycloak.yml
# Domain for Keycloak. Defaults to "keycloak.opencloud.test".
KEYCLOAK_DOMAIN=
# Admin user login name. Defaults to "kcadmin".
KEYCLOAK_ADMIN=
# Admin user login password. Defaults to "admin".
KEYCLOAK_ADMIN_PASSWORD=
# Configure the log level for Keycloak.
# Possible values are "TRACE", "DEBUG", "INFO", "WARN", "ERROR", "FATAL" and "OFF". Default is "INFO".
KC_LOG_LEVEL=
# Keycloak Database username. Defaults to "keycloak".
KC_DB_USERNAME=
# Keycloak Database password. Defaults to "keycloak".
KC_DB_PASSWORD=

## Demo Users ##
# Enable demo users and groups in the shared LDAP directory.
# To enable, create custom/ldap-keycloak-demo-users.yml with:
#   services:
#     ldap-server:
#       volumes:
#         - ./config/ldap/ldif/30_demo_users.ldif:/ldifs/30_demo_users.ldif
#         - ./config/ldap/ldif/40_demo_groups.ldif:/ldifs/40_demo_groups.ldif
#
# Then add it to: COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:traefik/opencloud.yml:traefik/collabora.yml:idm/ldap-keycloak.yml:traefik/ldap-keycloak.yml:custom/ldap-keycloak-demo-users.yml
# WARNING: Do not use in production.

### Radicale Setting ###
# Radicale is a small open-source CalDAV (calendars, to-do lists) and CardDAV (contacts) server.
# When enabled OpenCloud is configured as a reverse proxy for Radicale, providing all authenticated
# OpenCloud users access to a Personal Calendar and Addressbook
# Docker image to use for the Radicale Container
#RADICALE_DOCKER_IMAGE=opencloudeu/radicale
# Docker tag to pull for the Radicale Container
#RADICALE_DOCKER_TAG=latest
# Define the storage location for the Radicale data. Set the path to a local path.
# Ensure that the configuration and data directories are owned by the user and group with ID 1000:1000.
# This matches the default user inside the container and avoids permission issues when accessing files.
# Leaving it default stores data in docker internal volumes.
#RADICALE_DATA_DIR=/your/local/radicale/data

Certificates

Create the certs directory if you already have your signed certificates, insert them here.

Then create a certs.yml file under opencloud-compose\config\traefik\dynamic, add in the following:

tls:
  certificates:
    - certFile: /CERTSDIRECTORY/NAMEOFCERTIFICATE.crt
      keyFile: /CERTSDIRECTORY/NAMEOFCERTIFICATE.key

Self-Signed Certificate Creation

If the certificates have not been created, and you wish to use self-signed certificates, create a config file for the certificate creation in the earlier created certs directory.

Within the config file, add in the following:

[req]
default_bits = 2048
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no

[req_distinguished_name]
C=SG
ST=Singapore
L=Singapore
O=xxx
OU=IT
CN=cloud.xxx.ts.net

[v3_req]
keyUsage = keyEncipherment, digitalSignature
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

To create the certificates with the config file, run the below command.

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout server.key -out server.crt -config certificate.conf

• Change the days parameter if you wish for it to take longer to expire.

Docker-entrypoint-override.sh

Because we are running this on Windows, the docker-entrypoint-override.sh will not run as intended.

Replace it with this instead:

#!/bin/sh
# Minimal, POSIX-compatible entrypoint for Traefik.
# Ensure this file uses LF line endings.

set -eu

# Helper to append args
add_arg() { TRAEFIK_CMD="$TRAEFIK_CMD $1"; }

TRAEFIK_CMD="traefik"

add_arg "--log.level=${TRAEFIK_LOG_LEVEL:-ERROR}"
add_arg "--api.dashboard=true"
add_arg "--entryPoints.http.address=:${TRAEFIK_PORT_HTTP:-80}"
add_arg "--entryPoints.http.http.redirections.entryPoint.to=https"
add_arg "--entryPoints.http.http.redirections.entryPoint.scheme=https"
add_arg "--entryPoints.https.address=:${TRAEFIK_PORT_HTTPS:-443}"
add_arg "--entryPoints.https.transport.respondingTimeouts.readTimeout=12h"
add_arg "--entryPoints.https.transport.respondingTimeouts.writeTimeout=12h"
add_arg "--entryPoints.https.transport.respondingTimeouts.idleTimeout=3m"
add_arg "--providers.docker.endpoint=unix:///var/run/docker.sock"
add_arg "--providers.docker.exposedByDefault=false"
add_arg "--accessLog=${TRAEFIK_ACCESS_LOG:-false}"
add_arg "--accessLog.format=json"
add_arg "--accessLog.fields.headers.names.X-Request-Id=keep"

if [ "${TRAEFIK_SERVICES_TLS_CONFIG:-}" = "tls.certresolver=letsencrypt" ]; then
    echo "Configuring Traefik with Let's Encrypt..."
    add_arg "--certificatesResolvers.letsencrypt.acme.email=${TRAEFIK_ACME_MAIL:-example@example.org}"
    add_arg "--certificatesResolvers.letsencrypt.acme.storage=/certs/acme.json"
    add_arg "--certificatesResolvers.letsencrypt.acme.httpChallenge.entryPoint=http"
    add_arg "--certificatesResolvers.letsencrypt.acme.caserver=${TRAEFIK_ACME_CASERVER:-https://acme-v02.api.letsencrypt.org/directory}"
fi

if [ "${TRAEFIK_SERVICES_TLS_CONFIG:-}" = "tls=true" ]; then
    echo "Configuring Traefik with local certificates..."
    add_arg "--providers.file.directory=/etc/traefik/dynamic"
    add_arg "--providers.file.watch=true"
fi

if [ "${TRAEFIK_SERVICES_TLS_CONFIG:-}" != "tls=true" ] && [ "${TRAEFIK_SERVICES_TLS_CONFIG:-}" != "tls.certresolver=letsencrypt" ]; then
    echo "WARNING: Neither Let's Encrypt nor local certificates are enabled."
    echo "HTTPS will not work properly without certificate configuration."
fi

if [ -n "${TRAEFIK_CUSTOM_ARGS:-}" ]; then
    echo "Adding custom Traefik arguments: ${TRAEFIK_CUSTOM_ARGS}"
    TRAEFIK_CMD="$TRAEFIK_CMD $TRAEFIK_CUSTOM_ARGS"
fi

for arg in "$@"; do
    add_arg "$arg"
done

echo "Starting Traefik with command:"
echo "$TRAEFIK_CMD"

exec $TRAEFIK_CMD

Run docker compose up in the cmd in the opencloud-compose directory. Take note if there are any errors in the logs.

Once all of this is done, and there are no major errors that result in the server constantly restarting, your OpenCloud server is now accessible through the Tailscale service domain name created earlier.