You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Add initial configuration files for picard with Tailscale sidecar (#193)
* Add initial configuration files for picard with Tailscale sidecar
* Fix formatting issue in README.md
* Add Picard music tagger to available configurations in README.md
# MusicBrainz Picard with Tailscale Sidecar Configuration
2
+
3
+
This Docker Compose setup deploys **MusicBrainz Picard** alongside a **Tailscale sidecar container**, allowing secure access to your self-hosted music tagging and metadata management environment over your private **Tailscale network**. With this setup, Picard remains **private and reachable only from trusted devices within your Tailnet**, ensuring your media metadata library stays secure and isolated from the public internet.
4
+
5
+
## MusicBrainz Picard
6
+
7
+
[**MusicBrainz Picard**](https://picard.musicbrainz.org/) is the official cross-platform tag editor from [MusicBrainz](https://musicbrainz.org/). It uses the community-maintained MusicBrainz database to identify, tag, and organize your music files with accurate and rich metadata — including artist information, album art, release data, and more.
8
+
9
+
Picard supports a wide range of audio formats and integrates powerful plugins to streamline batch processing, fingerprinting (via AcoustID), and custom tagging workflows.
10
+
11
+
## Key Features
12
+
13
+
- 🎵 **Accurate Tagging** – Automatically identify and tag music files using MusicBrainz metadata.
14
+
- 🧠 **AcoustID Matching** – Use audio fingerprints to detect and tag tracks even without metadata.
15
+
- 🖼️ **Album Art Integration** – Fetch and embed high-quality cover art automatically.
16
+
- ⚙️ **Plugin Support** – Extend functionality with community or custom plugins.
17
+
- 📁 **Batch Processing** – Organize entire libraries with flexible renaming and folder rules.
18
+
- 🐳 **Docker-Ready** – Simple to deploy and run in containers.
19
+
- 🔐 **Private Access via Tailscale** – Keep your tagging environment accessible only on your Tailnet.
20
+
- 📦 **Open Source** – Actively maintained and community-driven.
21
+
22
+
## Why Self-Host?
23
+
24
+
When you manage large local music libraries, you may prefer **full privacy and control** over which metadata services your files connect to. Self-hosting Picard behind Tailscale offers:
25
+
26
+
- No exposure of ports to the public internet.
27
+
- Private access to your tagging environment from any authorized Tailscale device.
28
+
- A streamlined tagging workflow fully contained within your home media infrastructure.
29
+
30
+
With this setup, your tagging process is secured and contained — perfect for privacy-conscious audiophiles and homelab enthusiasts.
31
+
32
+
## Configuration Overview
33
+
34
+
In this deployment, a **Tailscale sidecar container** (for example `tailscale-picard`) connects your Picard instance to your private Tailnet. The main `picard` container uses:
35
+
36
+
```plain
37
+
network_mode: service:tailscale-picard
38
+
```
39
+
40
+
This means all Picard traffic — web interface, plugin updates, and library calls — travels securely through Tailscale.
# Make sure you have updated/checked the .env file with the correct variables.
12
+
# All the ${ xx } need to be defined there.
13
+
# Tailscale Sidecar Configuration
14
+
tailscale:
15
+
image: tailscale/tailscale:latest # Image to be used
16
+
container_name: tailscale-${SERVICE} # Name for local container management
17
+
hostname: ${SERVICE} # Name used within your Tailscale environment
18
+
environment:
19
+
- TS_AUTHKEY=${TS_AUTHKEY}
20
+
- TS_STATE_DIR=/var/lib/tailscale
21
+
- TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required
- TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The <addr>:<port> for the healthz endpoint
25
+
#- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS
26
+
configs:
27
+
- source: ts-serve
28
+
target: /config/serve.json
29
+
volumes:
30
+
- ./config:/config # Config folder used to store Tailscale files - you may need to change the path
31
+
- ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path
32
+
devices:
33
+
- /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work
34
+
cap_add:
35
+
- net_admin # Tailscale requirement
36
+
#ports:
37
+
# - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required
38
+
# If any DNS issues arise, use your preferred DNS provider by uncommenting the config below
39
+
#dns:
40
+
# - ${DNS_SERVER}
41
+
healthcheck:
42
+
test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational
43
+
interval: 1m# How often to perform the check
44
+
timeout: 10s# Time to wait for the check to succeed
45
+
retries: 3# Number of retries before marking as unhealthy
46
+
start_period: 10s# Time to wait before starting health checks
47
+
restart: always
48
+
49
+
# ${SERVICE}
50
+
application:
51
+
image: ${IMAGE_URL} # Image to be used
52
+
network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale
53
+
container_name: app-${SERVICE} # Name for local container management
54
+
environment:
55
+
- USER_ID=1000
56
+
- GROUP_ID=1000
57
+
- TZ=Europe/Amsterdam # Change according to your timezone or set by mapping /etc/localtime between the host and the container.
58
+
volumes:
59
+
- ./${SERVICE}-data/config:/config:rw
60
+
- ./${SERVICE}-data/music:/config:rw
61
+
depends_on:
62
+
tailscale:
63
+
condition: service_healthy
64
+
healthcheck:
65
+
test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running
66
+
interval: 1m# How often to perform the check
67
+
timeout: 10s# Time to wait for the check to succeed
68
+
retries: 3# Number of retries before marking as unhealthy
69
+
start_period: 30s# Time to wait before starting health checks
0 commit comments