diff --git a/core/installer/values-tmpl/tailscale-proxy.jsonschema b/core/installer/values-tmpl/tailscale-proxy.jsonschema
new file mode 100644
index 0000000..f42d895
--- /dev/null
+++ b/core/installer/values-tmpl/tailscale-proxy.jsonschema
@@ -0,0 +1,6 @@
+{
+  "type": "object",
+  "properties": {
+  },
+  "additionalProperties": false
+}
diff --git a/core/installer/values-tmpl/tailscale-proxy.md b/core/installer/values-tmpl/tailscale-proxy.md
new file mode 100644
index 0000000..14a1db6
--- /dev/null
+++ b/core/installer/values-tmpl/tailscale-proxy.md
@@ -0,0 +1,2 @@
+hostname: {{ .Global.PCloudEnvName }}-{{ .Global.Id }}-internal-proxy
+loginServer: headscale.{{ .Global.Domain }}
diff --git a/core/installer/values-tmpl/tailscale-proxy.yaml b/core/installer/values-tmpl/tailscale-proxy.yaml
new file mode 100644
index 0000000..308cac4
--- /dev/null
+++ b/core/installer/values-tmpl/tailscale-proxy.yaml
@@ -0,0 +1,41 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: namespaces-tailscale-proxy
+  namespace: {{ .Global.Id }}
+spec:
+  chart:
+    spec:
+      chart: charts/namespaces
+      sourceRef:
+        kind: GitRepository
+        name: pcloud
+        namespace: {{ .Global.Id }}
+  interval: 1m0s
+  values:
+    pcloudInstanceId: {{ .Global.Id }}
+    namespacePrefix: {{ .Global.NamespacePrefix }}
+    namespaces:
+    - tailscale-proxy
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: tailscale-proxy
+  namespace: {{ .Global.Id }}
+spec:
+  targetNamespace: {{ .Global.NamespacePrefix }}tailscale-proxy
+  dependsOn:
+    - name: namespaces-tailscale-proxy
+      namespace: {{ .Global.Id }}
+  chart:
+    spec:
+      chart: charts/tailscale
+      sourceRef:
+        kind: GitRepository
+        name: pcloud
+        namespace: {{ .Global.Id }}
+  interval: 1m0s
+  values:
+    hostname: {{ .Global.PCloudEnvName }}-{{ .Global.Id }}-internal-proxy
+    loginServer: https://headscale.{{ .Global.Domain }} # TODO(gio): take headscale subdomain from configuration