Deploying and Configuring TeslaMate on Linux with Secure Tailscale Access

TeslaMate is an open-source and free self-hosted data logger and visualization platform for Tesla vehicles.
It lets you collect, store, and analyze your driving and charging data while maintaining full ownership — no third-party subscriptions required.

In contrast, commercial services such as TeslaFi offer similar analytics but charge monthly fees.
If you prefer a self-managed, cost-free alternative, this guide will help you set up TeslaMate from scratch.

Although TeslaMate can run on both home servers and cloud hosts, I strongly recommend cloud deployment.
A reliable, always-on instance ensures uninterrupted data capture — crucial because TeslaMate requires 24×7 connectivity.
I personally learned this the hard way: a failed Xfinity modem once cost me 12 hours of missing data, including one charge and several trips.

Using a free-tier Oracle Cloud VM (1 vCPU / 1 GB RAM) provides stable uptime without ongoing cost.
This tutorial demonstrates installation on Ubuntu 24.04.3 LTS, but the similar process works on any Linux distros.

---

1. Overview

In this guide, we’ll cover:

• Installing TeslaMate via Docker Compose
• Securing access with Tailscale private networking
• Performing initial configuration and Grafana linking
• Backing up and restoring your TeslaMate data

---

2. Prepare the Environment

First, update your system and install basic utilities:

sudo apt update && sudo apt upgrade -y
sudo apt install curl git jq unzip -y

Next, create a working directory for TeslaMate:

mkdir -p ~/application/teslamate
cd ~/application/teslamate

This folder will hold your docker-compose.yml file, data volumes, and backups.

---

3. Install Docker or Podman

To install Docker:

curl -fsSL https://get.docker.com | sudo sh
sudo usermod -aG docker $USER
newgrp docker
docker --version
docker compose version

💡 If you prefer Podman, use version 4.6 or newer which natively supports the compose sub-command.

---

4. Install and Configure Tailscale

Before installing Tailscale, rename your host to a clear identifier.
For example:

sudo hostnamectl set-hostname device-name

Here, device-name can be any name you prefer — for instance, you might name it after the service (e.g., teslamate) or your host’s purpose.

Then install and connect to your Tailscale network:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Authorize the node when prompted and verify:

tailscale status
tailscale ip -4

You’ll later reach TeslaMate at
http://device-name.tailnet-name.ts.net:4000

If you prefer, you can continue using HTTP instead — since this setup is internal-only, it’s safe enough. However, if you ever plan to access TeslaMate from the public internet, HTTPS is strongly recommended.

💡 Note:
If you decide not to use Tailscale, you can still follow the rest of this tutorial by using your host’s IP address directly. This approach works especially well if you’re hosting TeslaMate on a home server within your local network.

---

5. Improve Performance by Enabling Swap (Optional)

If your host has 2 GB RAM or more, skip this section.
TeslaMate and Grafana will run smoothly without additional swap.

For smaller free-tier VMs (1 GB RAM), create a 1 GB swapfile to avoid memory pressure:

sudo fallocate -l 1G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
free -h
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab
sudo swapoff -a && sudo swapon -a

---

6. Deploy TeslaMate via Docker Compose

Follow the official installation guide:
👉 https://docs.teslamate.org/docs/installation/docker

Before editing docker-compose.yml, generate secure credentials:

# PostgreSQL password (used by TeslaMate, Grafana, and the database)
openssl rand -base64 24

# Encryption key for Tesla API tokens (TeslaMate only)
openssl rand -hex 32

Use these values to replace password and secretkey in the compose file.

Important: The same database password must appear in three locations:

1. database → POSTGRES_PASSWORD=...
2. teslamate → DATABASE_PASS=...
3. grafana → DATABASE_PASS=...

Then deploy:

docker compose up -d
docker ps

Verify via browser:

• TeslaMate → http://device-name.tailnet-name.ts.net:4000
• Grafana → http://device-name.tailnet-name.ts.net:3000

---

7. Ensure Auto-Start TeslaMate on Boot (Optional)

By default, containers started with docker compose up -d will restart after a reboot.
To ensure consistency, create a persistent systemd service:

cat /etc/systemd/system/teslamate.service
[Unit]
Description=TeslaMate Docker Compose Service
Requires=docker.service
After=docker.service

[Service]
Type=oneshot
RemainAfterExit=true
User=ubuntu
WorkingDirectory=/home/ubuntu/application/teslamate
ExecStart=/usr/bin/docker compose up -d
ExecStop=/usr/bin/docker compose down
TimeoutStartSec=0

[Install]
WantedBy=multi-user.target

Enable it:

sudo systemctl enable teslamate

---

8. Configure TeslaMate

After TeslaMate and Grafana start successfully, complete these setup steps.

1. Set Up TeslaMate and Tesla API Token

TeslaMate requires a valid Tesla API access token to retrieve your vehicle data.
You’ll need to generate this token securely, then paste it into TeslaMate during the initial setup.

To generate a token yourself, use one of the following trusted tools:

• Tesla Auth (macOS, Linux, Windows)
• Auth app for Tesla (iOS, macOS)

Once you have your access token and refresh token, open TeslaMate at:
http://device-name.tailnet-name.ts.net:4000

Paste your token into the setup form to complete authorization.
TeslaMate will encrypt and store them securely using your ENCRYPTION_KEY.

Reference:
👉 Official TeslaMate FAQ – How to generate your own tokens

---

2. Name Your Vehicle in the Tesla App

Grafana identifies vehicles by name.
If your car has no name, dashboards may show “null” above panels.
Set a name in your Tesla mobile app for using TeslaMate.

Reference:
👉 Why “null” is displayed in Grafana

---

3. Configure Cross Linking Between TeslaMate and Grafana

Open TeslaMate settings:
http://device-name.tailnet-name.ts.net:4000/settings

Set:

• Web App: http://device-name.tailnet-name.ts.net:4000
• Dashboards: http://device-name.tailnet-name.ts.net:3000

This allows direct navigation between TeslaMate and Grafana dashboards.

---

4. Modify Grafana Credentials

Grafana defaults:

• URL: http://device-name.tailnet-name.ts.net:3000
• Username: admin
• Password: admin

You’ll be prompted to change the password on first login — do this immediately.

---

9. Backup and Restore

This section follows the official Backup & Restore documentation and is especially useful for migrating data between systems.

Backup

Create a PostgreSQL dump:

docker compose exec -T database pg_dump -U teslamate teslamate > teslamate.bck
gzip teslamate.bck

Security Note:
Your Tesla API tokens in the backup are encrypted using your ENCRYPTION_KEY and cannot be directly read.
However, if both teslamate.bck and your docker-compose.yml (containing the same key) are compromised, the tokens could be decrypted.

👉 Recommendation:
Keep your docker-compose.yml securely stored and never share it publicly.
If a new environment uses a different ENCRYPTION_KEY, TeslaMate will simply ask you to log in again.

If you suspect your Tesla API token has been leaked, revoke it by changing Your Tesla Account Password. Changing your Tesla account password will invalidate all existing API tokens and force all third-party applications and the Tesla mobile app to re-authenticate. This is the most effective and immediate way to nullify a compromised token.

---

Restore

To restore from a previous backup:

gunzip teslamate.bck.gz
docker compose exec -T database psql -U teslamate teslamate < teslamate.bck

Restart:

docker compose restart

Your historical data should now appear in TeslaMate and Grafana.

---

10. Notes & Troubleshooting

• Memory: TeslaMate recommends ≥ 2 GB RAM; enable swap if using a 1 GB VM.
• Timezone: TeslaMate stores data in UTC. Grafana automatically adjusts data visualization according to your browser’s timezone. Setting TZ for the container is optional but helpful for debugging container logs.
• Security: With Tailscale, access stays private and encrypted; no public exposure.

---

12. Conclusion

You now have a stable, self-hosted TeslaMate instance running securely inside your private Tailscale network.
This deployment combines continuous cloud uptime, internal-only access, and complete data ownership — all without subscription costs.
Backups ensure your data is safe, while Grafana and Tailscale make analytics convenient and private.

Whether you host it in the cloud or at home, this setup provides a robust, privacy-preserving foundation for Tesla data tracking and visualization.

Enjoy it.