diff --git a/docker/bastion-tailscale/Dockerfile b/docker/bastion-tailscale/Dockerfile
index e69de29..46d4225 100644
--- a/docker/bastion-tailscale/Dockerfile
+++ b/docker/bastion-tailscale/Dockerfile
@@ -0,0 +1,20 @@
+FROM alpine:edge
+
+RUN apk upgrade --no-cache \
+  && apk add --no-cache \
+    tailscale \
+    nano \
+    openssh-client \
+    rclone \
+    docker \
+    docker-rootless-extras \
+    docker-cli-compose \
+    bash \
+    coreutils \
+    gcompat \
+    croc
+
+COPY entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+VOLUME [ "/var/lib/tailscale" ]
+
+ENTRYPOINT [ "/usr/local/bin/docker-entrypoint.sh" ]
\ No newline at end of file
diff --git a/docker/bastion-tailscale/README.md b/docker/bastion-tailscale/README.md
new file mode 100644
index 0000000..06329c0
--- /dev/null
+++ b/docker/bastion-tailscale/README.md
@@ -0,0 +1,10 @@
+# Docker-based SSH Bastion over 
+
+## Setup
+
+This image is used as part of my [localdev Docker Compose config](../localdev/docker-compose.yml)
+by building from source.
+
+```bash
+docker build -t bastion-tsnet .
+```
diff --git a/docker/bastion-tailscale/entrypoint.sh b/docker/bastion-tailscale/entrypoint.sh
new file mode 100755
index 0000000..768b275
--- /dev/null
+++ b/docker/bastion-tailscale/entrypoint.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -xe
+
+TAILSCALE_TAGS=${TAILSCALE_TAGS:-"tag:docker,tag:ssh,tag:caddy"}
+TAILSCALE_DATADIR=${TAILSCALE_DATADIR:-"/var/lib/tailscale"}
+TAILSCALE_DATADIR_MOUNTED=${TAILSCALE_DATADIR_MOUNTED:-"false"}
+
+# TODO: Migrate this to a init-based setup, see linuxserver images
+if [[ $TAILSCALE_DATADIR != "" ]] && [[ $TAILSCALE_DATADIR_MOUNTED != "false" ]]; then
+  tailscaled -tun userspace-networking -state "${TAILSCALE_DATADIR}/tailscaled.state" -statedir "${TAILSCALE_DATADIR}" -sock5-server localhost:8081 -outbound-http-proxy-listen localhost:8080 &
+else
+  tailscaled -tun userspace-networking -state "mem:" -sock5-server localhost:8081 -outbound-http-proxy-listen localhost:8080 &
+fi
+
+if ! tailscale status >> /dev/null && [[ $TAILSCALE_AUTHKEY != "" ]]; then
+  tailscale up --accept-routes --advertise-exit-node --advertise-connector --ssh --advertise-tags="${TAILSCALE_TAGS}" --auth-key="$TAILSCALE_AUTHKEY"
+fi
+
+if [[ $1 == "" ]]; then
+  echo "Bastion up, you can now connect via Tailscale: $(tailscale ip)"
+  sleep infinity
+else
+  echo "Running: $*"
+  "$@"
+fi
\ No newline at end of file
diff --git a/docker/localdev/.env b/docker/localdev/.env
new file mode 100644
index 0000000..e69de29
diff --git a/docker/localdev/.env.localdev b/docker/localdev/.env.localdev
new file mode 100644
index 0000000..b2a752d
--- /dev/null
+++ b/docker/localdev/.env.localdev
@@ -0,0 +1,28 @@
+#/-------------------[DOTENV_PUBLIC_KEY]--------------------/
+#/            public-key encryption for .env files          /
+#/       [how it works](https://dotenvx.com/encryption)     /
+#/----------------------------------------------------------/
+DOTENV_PUBLIC_KEY_LOCALDEV="03fb9a6d1084895a85aae537c9a1253ab2b08d78b9b6aacb4b29683478d3a59f58"
+
+# .env.localdev
+
+# Redis
+REDIS_PASSWORD="encrypted:BDua/uTzWFYpc3brucFNnufKBagx9TQdKEj9/L8S/xR2oTm0WfE6mwMRjjY2uOLRdwaGbcxCoXIUrFkanExSF/2F5e3aw4SDZ3bzcPEnI+ZBOc0viBuxtp2gODvgxwAUF+ZIBaN++8do7TivYQ3s6BMnpGseP836X1MyAXAZI9q5wymrqt9waIR9K6FS4c6PUB7pG1DREvk7+nTlrDPF6BLqGtMEB/777PcI9yW5RM33RwxDrQS1NV3R4f/ZwxZZO6oq/qk62aN6bZXK/5JyiUza8fWfd1CgP0ApaBRBNJm1"
+
+# MySQL
+MYSQL_ROOT_PASSWORD="encrypted:BOjAqS1lKTI2E1mScGbpbSmnyLRxHNyAiMJ+VEPN/G11mK0xWC78i0BixBz3JtlzVaVq7nrg5C1MMF2nJYT0Ao90T2pm+I5NkMjA4nEPXRRVdpa50ofJi3Hrh/JO4J0IHMYs4Tuh/81lnThcqQXts8wGaXmdG08qaBZtF+WmrEYG"
+MYSQL_USER=ajhalili2006
+MYSQL_PASSWORD="encrypted:BLhklRp9qTdF2nEEf/bOO48FbOddGMjN2na9XLzgLEfxLxaOLiXb4Ff2wgoWT5eZ1TLbpsV5t51b7qvJY2iTyeFWRBufGKLVEIrFFNXZXkmamA6KKdKt7zxjEqzvlPeKZoN5eKfQNCYdxUbW2PEls72Rvb3/O/ib+GRnvoe/MRpT"
+MYSQL_DATABASE=ajhalili2006
+
+# MariaDB
+MARIADB_AUTO_UPGRADE=yes
+
+# Postgres
+POSTGRES_USER=ajhalili2006
+POSTGRES_PASSWORD="encrypted:BPar1VivqYOQwuF6KwFbITkn5fkSZTzRNU7oQaSVKydyL+wBU1qfiVqJi+rMz025G1IXl+bmGZMNm8UvbnIatp0kh8n8kwDLe3BFSnnsiowywJfhq/oe2rCue1dqbaz9AtYVk6CM26GcGuyaoOb4S57UwNReI4UZSeRHht0Bt9v9"
+POSTGRES_DATABASE=ajhalili2006
+
+# Tailscale
+TAILSCALE_AUTHKEY="encrypted:BDb/zMwVDtlwpXlb3TnHBd6SrNpt9Y2uqRqgZe+zQGnXZwniiiNfnKaHzBOFbrIDibydsrqfEB9YKz7tQ3d2N2jy6GpyucA8O6mofMMlPidWbX8mSaiI1Og79O5FoO85IHXQsw1nk7+NrH+q7MxOWt6r28uhSkYC67KkUI0vtQLV5rsAIHblkQvJcrT0t1F9LOS7bV6Kll/UqAM6un9sYIY="
+TAILSCALE_DATADIR_MOUNTED=1
diff --git a/docker/localdev/docker-compose.yml b/docker/localdev/docker-compose.yml
new file mode 100644
index 0000000..c9466ba
--- /dev/null
+++ b/docker/localdev/docker-compose.yml
@@ -0,0 +1,89 @@
+# SPDX-License-Identifier: MPL
+# This Docker Compose file covers my entire local dev setup on both my homelab
+# and my (future) laptop.
+
+services:
+  proxyparty:
+    image: ghcr.io/andreijiroh-dev/docker-images/caddy
+    volumes:
+      - ./caddy:/etc/caddy
+      - caddy:/data/caddy
+    cap_add:
+      - NET_ADMIN
+      - NET_BIND_SERVICE
+    ports:
+      - 80:80
+      - 443:443
+      - 2019:2019
+    networks:
+      - tailscale
+      - proxyparty-router
+    command: caddy run --environ --resume
+
+  bastion:
+    build:
+      context: ../bastion-tailscale
+    volumes:
+      # TODO: Update this path if you're rootless
+      - /var/run/docker.sock:/var/run/docker.sock
+    env_file:
+      - .env.localdev.decrypted
+    networks:
+      - tailscale
+
+  redis:
+    image: bitnami/redis:7.4
+    env_file:
+    - .env.localdev.decrypted
+    ports:
+      - 6379:6379
+    volumes:
+      - db-redis:/bitnami/redis/data
+    networks:
+      - tailscale
+
+  mysql:
+    image: mysql:8.0
+    restart: unless-stopped
+    env_file:
+    - .env.localdev.decrypted
+    volumes:
+      - db-mysql:/var/lib/mysql
+    networks:
+      - tailscale
+    ports:
+      - 3306:3306
+
+  postgres:
+    image: timescale/timescaledb:latest-pg16
+    restart: unless-stopped
+    env_file:
+    - .env.localdev.decrypted
+    volumes:
+      - db-postgres:/var/lib/postgresql/data
+    ports:
+      - 5432:5432
+    networks:
+      - tailscale
+
+networks:
+  proxyparty-router:
+    enable_ipv6: true
+    name: proxyparty-docker
+    attachable: true
+  tailscale:
+    enable_ipv6: true
+    name: tsnet-router
+    attachable: true
+
+volumes:
+  db-redis:
+    name: redis-data
+  db-mysql:
+    name: mysql-data
+  db-mariadb:
+    name: mariadb-data
+  db-postgres:
+    name: psql-data
+  caddy:
+    name: caddy-data
\ No newline at end of file