how can I use an IP for SSH to a remote server, and use another to expose my apps?

[StellarRounin]

hi,

Currently I have dokploy in a VPS and a remote server connecting to my home server using tailscale. I want to be able to connect to my remote home server using the tailscale IP, but use my local IP to expose my apps because I want to access them locally without using the tailscale vpn.

The UI uses the IP for both, access with ssh and deploying apps...

[dosubot[bot]]

Hi @StellarRounin! I'm Dosu and I’m helping the dokploy team.

Currently, Dokploy uses a single IP address field for both SSH connection and application exposure on remote servers — there's no built-in way to separate these [1] [2].

This is an actively requested feature. Several related issues exist:

• #2615 — Distinguish between internal and external IPs [3]
• #4312 — Native Tailscale integration [4]
• #2915 — Split IP configuration for port binding [5]

Workarounds people are using in the meantime:

1. Use the Tailscale IP in Dokploy (for SSH) and configure custom domains with A records pointing to your local IP for app access, bypassing the auto-generated sslip.io domains.
2. Manual Traefik configuration — override Dokploy's automatic domain setup to route traffic through your local IP.
3. Firewall rules — restrict which interfaces expose which ports.

None of these are ideal. You may want to add a 👍 on issue #2615 or #4312 to signal interest in having this supported natively.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[ashik4339]

There's genuinely only one ipAddress field per server in the schema, so the bot reply is right that Dokploy doesn't have a first-class "SSH IP" vs "app IP" split in the UI. But looking at how that field is actually used in the codebase, there's a workaround that gets you what you want:

The ipAddress field is used for exactly two things:

1. As the SSH connection host (packages/server/src/utils/servers/remote-docker.ts) — this is how Dokploy's control plane reaches your server to deploy.
2. As a suggested default when auto-generating a random preview domain (sslip.io-style) — purely a UI convenience, nothing enforced.

It is not used to configure what interface Traefik binds to, or to restrict/whitelist which IP your apps are reachable on. Traffic to your apps is routed entirely by wherever your DNS records point — Traefik just needs to be reachable on whatever interface that traffic arrives on.

So: set the server's ipAddress in Dokploy to your Tailscale IP (so deploys/SSH go over the private, more reliable path), and separately point your domain's DNS A records at your local/public IP as normal. Traefik on that box will still answer on all its interfaces, so requests coming in via the public IP + DNS work exactly the same as if the "IP" field matched. You don't lose anything by having them differ — Dokploy just doesn't use that field for app exposure at all.