Hi everyone,

I’ve deployed HashiCorp Vault in a Railway project and want to access the UI through the Tailscale Subnet Router.
The goal is to have full access to the internal railway.internal network, not just selective ports via the forwarder.

Setup (shortened)

• Service: Vault (official HashiCorp image)

• Config (excerpt):

  ui = true
  api_addr = "http://0.0.0.0:8200"
  
  listener "tcp" {
    address     = "0.0.0.0:8200"
    tls_disable = true
  }
  
  storage "postgresql" {
    connection_url = "…"
    ha_enabled     = true
  }
  
  disable_mlock = true
  

• Dockerfile (excerpt):

  FROM hashicorp/vault:1.15
  COPY vault-config.hcl /vault/config/vault-config.hcl
  COPY docker-entrypoint.sh /docker-entrypoint.sh
  RUN chmod +x /docker-entrypoint.sh
  
  EXPOSE 8200
  ENTRYPOINT ["/docker-entrypoint.sh"]
  

• Subnet Router: deployed via Railway template

• Workstation: Tailscale running with --accept-routes --accept-dns

Observation

• DNS resolution works: <service>.railway.internal resolves to an internal address

• But connection fails:

  nc -zv <service>.railway.internal 8200
  → Connection refused
  

• Railway logs show Vault starting and supposedly listening on 0.0.0.0:8200.

Question

• Is EXPOSE 8200 enough for the port to be reachable via the Subnet Router?

• Is there any extra configuration needed on Railway to expose UI ports (HTTP) through the Subnet Router?

• Has anyone successfully exposed Vault or similar services (with a web UI) through the Subnet Router into their Tailnet?

Thanks a lot for any pointers!