diff --git a/.env.example b/.env.example
index 79b590a..50de537 100644
--- a/.env.example
+++ b/.env.example
@@ -1,3 +1,6 @@
 CONTAINER_REGISTRY_URL=
 LACUNA_MYSQL_ROOT_PASSWORD=
 CADDY_DOMAIN=
+TAILSCALE_AUTHKEY=
+PORTAINER_AGENT_EDGE_ID=
+PORTAINER_AGENT_EDGE_KEY=
diff --git a/docker-compose.yml b/docker-compose.yml
index 19070ce..7e4c345 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -107,20 +107,9 @@ services:
       - ./data/caddy-data:/data
       - ./data/caddy-config:/config
 
-  phpmyadmin:
-    container_name: phpmyadmin
-    image: phpmyadmin:5.2-apache
-    restart: unless-stopped
-    environment:
-      PMA_HOST: mysql
-    depends_on:
-      - mysql
-    links:
-      - mysql
-
   server:
     image: ${CONTAINER_REGISTRY_URL:?error}/tlecommunity/server:latest
-    # command: '/bin/bash start_lacuna.sh'
+    command: '/bin/bash bin/start_lacuna.sh'
     container_name: server
     restart: unless-stopped
     depends_on:
@@ -233,6 +222,89 @@ services:
     environment:
       PORT: 5999
 
+  #
+  # Management
+  #
+
+  phpmyadmin-tailscale:
+    image: tailscale/tailscale:latest
+    container_name: phpmyadmin-tailscale
+    hostname: tle-meanjin-one-phpmyadmin
+    environment:
+      - TS_AUTHKEY=${TAILSCALE_AUTHKEY:?error}
+      - TS_EXTRA_ARGS=--advertise-tags=tag:container
+      - TS_SERVE_CONFIG=/config/phpmyadmin.json
+      - TS_STATE_DIR=/var/lib/tailscale
+      - TS_USERSPACE=false
+      - TS_ENABLE_HEALTH_CHECK=true
+    healthcheck:
+      test: ['CMD', 'wget', '--spider', '-q', 'http://127.0.0.1:9002/healthz']
+      interval: 10s
+      timeout: 3s
+    volumes:
+      - ./data/tailscale-phpmyadmin:/var/lib/tailscale
+      - ./tailscale/phpmyadmin:/config
+    devices:
+      - /dev/net/tun:/dev/net/tun
+    cap_add:
+      - net_admin
+      - sys_module
+    restart: unless-stopped
+
+  phpmyadmin:
+    container_name: phpmyadmin
+    image: phpmyadmin:5.2-apache
+    restart: unless-stopped
+    network_mode: service:phpmyadmin-tailscale
+    environment:
+      PMA_HOST: mysql
+    depends_on:
+      - mysql
+
+  portainer-agent-tailscale:
+    image: tailscale/tailscale:latest
+    container_name: portainer-agent-tailscale
+    hostname: tle-meanjin-one-portainer-agent
+    environment:
+      - TS_AUTHKEY=${TAILSCALE_AUTHKEY:?error}
+      - TS_EXTRA_ARGS=--advertise-tags=tag:container
+      - TS_SERVE_CONFIG=/config/portainer-agent.json
+      - TS_STATE_DIR=/var/lib/tailscale
+      - TS_USERSPACE=false
+      - TS_ENABLE_HEALTH_CHECK=true
+    healthcheck:
+      test: ['CMD', 'wget', '--spider', '-q', 'http://127.0.0.1:9002/healthz']
+      interval: 10s
+      timeout: 3s
+    volumes:
+      - ./data/tailscale-portainer-agent:/var/lib/tailscale
+      - ./tailscale/portainer-agent:/config
+    devices:
+      - /dev/net/tun:/dev/net/tun
+    cap_add:
+      - net_admin
+      - sys_module
+    restart: unless-stopped
+
+  portainer-agent:
+    image: portainer/agent:lts
+    container_name: portainer-agent
+    restart: always
+    environment:
+      - EDGE=1
+      - EDGE_INSECURE_POLL=1
+      - EDGE_ID=${PORTAINER_AGENT_EDGE_ID:?error}
+      - EDGE_KEY=${PORTAINER_AGENT_EDGE_KEY:?error}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /var/lib/docker/volumes:/var/lib/docker/volumes
+      - /:/host
+      - ./data/portainer-agent:/data
+    network_mode: service:portainer-agent-tailscale
+    depends_on:
+      portainer-agent-tailscale:
+        condition: service_healthy
+
 networks:
   default:
     name: lacuna
diff --git a/tailscale/phpmyadmin/phpmyadmin.json b/tailscale/phpmyadmin/phpmyadmin.json
new file mode 100644
index 0000000..f006eda
--- /dev/null
+++ b/tailscale/phpmyadmin/phpmyadmin.json
@@ -0,0 +1,20 @@
+{
+  "TCP": {
+    "443": {
+      "HTTPS": true
+    }
+  },
+  "Web": {
+    "${TS_CERT_DOMAIN}:443": {
+      "Handlers": {
+        "/": {
+          "Proxy": "http://127.0.0.1:80"
+        }
+      }
+    }
+  },
+  "AllowFunnel": {
+    "${TS_CERT_DOMAIN}:443": false
+  }
+}
+
diff --git a/tailscale/portainer-agent/portainer-agent.json b/tailscale/portainer-agent/portainer-agent.json
new file mode 100644
index 0000000..251dfd5
--- /dev/null
+++ b/tailscale/portainer-agent/portainer-agent.json
@@ -0,0 +1,20 @@
+{
+  "TCP": {
+    "443": {
+      "HTTPS": true
+    }
+  },
+  "Web": {
+    "${TS_CERT_DOMAIN}:443": {
+      "Handlers": {
+        "/": {
+          "Proxy": "http://127.0.0.1:9001"
+        }
+      }
+    }
+  },
+  "AllowFunnel": {
+    "${TS_CERT_DOMAIN}:443": false
+  }
+}
+