Mealie — Proxmox LXC¶

Mealie is a self-hosted recipe manager and meal planner. It's installed via the community Proxmox helper script and served over HTTPS using tailscale serve, which terminates TLS via Tailscale's CA and proxies traffic to Mealie's local port — no separate reverse proxy or certificate management needed.

1. Create the LXC¶

Run the helper script in the Proxmox host shell:

Go to the Proxmox VE Helper Scripts site and run the Mealie script from the Proxmox shell.

After the LXC is created, open the Mealie web UI and change the default username and password.

2. Configure LXC for Tailscale (TUN Device)¶

Tailscale requires access to /dev/net/tun to create its virtual network interface. Unprivileged LXCs don't have this by default. On the Proxmox host, edit the container config (replace 103 with your VMID):

nano /etc/pve/lxc/103.conf

Add at the bottom:

lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file

Reboot the Mealie LXC.

3. Install and Connect Tailscale¶

In the Mealie LXC console, install Tailscale:

curl -fsSL https://tailscale.com/install.sh | sh

Start Tailscale and authenticate:

tailscale up

Copy the URL displayed into a browser and log in to your Tailscale account.

In the Tailscale admin console, make sure MagicDNS is enabled, and enable HTTPS.

4. Configure Tailscale Serve (HTTPS)¶

tailscale serve acts as a local reverse proxy — it obtains a TLS certificate from Tailscale's CA and forwards HTTPS traffic on port 443 to Mealie running on port 9000. This makes Mealie accessible at https://mealie.<tailnet>.ts.net with a valid cert, with no manual certificate setup.

tailscale serve --bg --https=443 http://localhost:9000

You should see:

Serve started and running in the background.
To disable the proxy, run: tailscale serve --https=443 off

Mealie is now accessible over HTTPS on your tailnet.