diff --git a/03frontends.cfg b/03frontends.cfg
index 31e38a4..9ab9a16 100644
--- a/03frontends.cfg
+++ b/03frontends.cfg
@@ -321,18 +321,18 @@ frontend frontend_default
   acl www hdr(host) -i benoit.jp.net
   acl www hdr(host) -i www.benoit.jp.net
 
-  # Allow mxmon
-  acl allowed_ips src 5.78.92.102 2a01:4ff:1f0:c14e::1
+  # Allow mxmon + tailscale
+  acl allowed_ips src 5.78.92.102 2a01:4ff:1f0:c14e::1 100.0.0.0/8 fd7a:115c:a1e0::/64
 
-  http-request deny if adguard !JP !SG !letsencrypt !allowed_ips
-  http-request deny if beszel !JP !SG !letsencrypt !allowed_ips
-  http-request deny if kanboard !JP !SG !letsencrypt !allowed_ips
-  http-request deny if mailcow !JP !SG !letsencrypt !allowed_ips
-  http-request deny if mailcow-backup !JP !SG !letsencrypt !allowed_ips
-  http-request deny if miniflux !JP !SG !letsencrypt !allowed_ips
-  http-request deny if navidrome !JP !SG !letsencrypt !allowed_ips
-  http-request deny if photoprism !JP !SG !letsencrypt !allowed_ips
-  http-request deny if vaultwarden !JP !SG !letsencrypt !allowed_ips
+  http-request deny if adguard !letsencrypt !allowed_ips
+  http-request deny if beszel !letsencrypt !allowed_ips
+  http-request deny if kanboard !letsencrypt !allowed_ips
+  http-request deny if mailcow !letsencrypt !allowed_ips
+  http-request deny if mailcow-backup !letsencrypt !allowed_ips
+  http-request deny if miniflux !letsencrypt !allowed_ips
+  http-request deny if navidrome !JP !letsencrypt !allowed_ips
+  http-request deny if photoprism !JP !FR !letsencrypt !allowed_ips
+  http-request deny if vaultwarden !letsencrypt !allowed_ips
 
   use_backend adguard if adguard
   use_backend archive if archive