Send curl, git & npm through a specific tailnet

The idea#

You want one command — curl against an internal API, npm install from a private registry, git clone from an internal host — to reach a tailnet without installing a system-wide Tailscale client or flipping your whole machine onto that network. TailMux exposes a local proxy on 127.0.0.1:43100, and any tool that honors HTTP_PROXY / HTTPS_PROXY / ALL_PROXY can borrow it.

There is no --profile flag on run or env. You don't pick a tailnet — you address a host, and TailMux routes the request to whichever profile owns that hostname's suffix. A request to api.work-tailnet.ts.net goes through the profile that claims .work-tailnet.ts.net; one to build.home-lab.ts.net goes through the profile that owns .home-lab.ts.net. Routing is by suffix, with no cross-profile fallback, so the right tailnet is selected purely from the hostname you type.

(With the macOS app running, the router is already up — tailmux run and tailmux env work with no extra setup.)

tailmux run for one command#

tailmux run command [args...] runs a single command with the proxy variables set in that command's environment only. Your surrounding shell keeps its own environment untouched — nothing leaks past the one invocation.

$tailmux run curl https://api.work-tailnet.ts.net/health

Flags that belong to the wrapped command need to get past TailMux's own parser. Add -- so everything after it is handed straight to the command:

$tailmux run -- curl -v https://api.work-tailnet.ts.net/health

tailmux env for a whole shell#

When you want every command in the current shell routed, use tailmux env. It takes no flags and simply prints the exports; you apply them with eval:

$eval "$(tailmux env)"

The exports it emits look like this:

1export HTTP_PROXY=http://127.0.0.1:431002export HTTPS_PROXY=http://127.0.0.1:431003export ALL_PROXY=socks5h://127.0.0.1:431004export NO_PROXY=localhost,127.0.0.1,::1

From there, plain curl, git, and npm all flow through TailMux until you close the shell or unset the variables. NO_PROXY keeps loopback traffic local. Prefer run for a quick one-off; reach for env when a whole session — a build, a series of API calls — should target tailnet hosts.

Use the proxy path only for classified destinations#

The proxy selects a TailMux profile from a configured hostname suffix. It is not a generic internet proxy and it does not silently choose a profile for an unclassified destination. Use run or env for profile-owned hosts; keep ordinary public browsing and unrelated command traffic outside that proxy environment.

Read the limitations and routing model before relying on this path for a build, package manager, or mixed public/private workflow.

What honors the proxy#

Because this is standard proxy-environment plumbing, it works with any tool that reads those variables: curl, git over HTTPS, npm, pip, go, and kubectl (which honors the proxy for its API server). No per-tool configuration — they all pick up HTTP_PROXY / ALL_PROXY on their own.

Examples#

Curl an internal API on the work tailnet, just for this one call:

$tailmux run -- curl -sS https://api.work-tailnet.ts.net/v1/status

Install from a private npm registry hosted on a tailnet:

$tailmux run -- npm install --registry https://registry.corp.example.com/

Clone an HTTPS repo from an internal host (note: HTTPS, not git@):

$tailmux run -- git clone https://git.home-lab.ts.net/team/service.git

Each request is routed by its hostname suffix, so the same proxy reaches whichever tailnet owns the host you name. The owning profile must be logged in first with tailmux profile login <name>. See all the verbs on the commands reference, the broader setup in work & personal tailnets, and pricing for licensing. TailMux runs on macOS and Linux and is not affiliated with Tailscale.