cryodev/docs/services/tailscale.md

Tailscale Client

Tailscale clients connect to the self-hosted Headscale server to join the mesh VPN.

References

• Tailscale Documentation
• Headscale Client Setup

Setup

Generate Auth Key

On the Headscale server (cryodev-main):

# Look up user ID
sudo headscale users list
# Create preauth key (use the user ID for "default")
sudo headscale preauthkeys create --expiration 99y --reusable --user <ID>

Add to Secrets

sops hosts/<hostname>/secrets.yaml

tailscale:
  auth-key: "your-preauth-key"

Configuration

# In your host configuration
{ config, ... }:
{
  sops.secrets."tailscale/auth-key" = { };
  
  services.tailscale = {
    enable = true;
    authKeyFile = config.sops.secrets."tailscale/auth-key".path;
    extraUpFlags = [
      "--login-server=https://headscale.cryodev.xyz"
    ];
  };
}

Usage

Check Status

tailscale status

View IP Address

tailscale ip

Ping Another Node

tailscale ping <hostname>

SSH to Another Node

ssh user@<hostname>
# or using Tailscale IP
ssh user@100.64.0.X

MagicDNS

With Headscale's MagicDNS enabled, you can reach nodes by hostname:

ping cryodev-pi
ssh steffen@cryodev-main

Troubleshooting

Check Service Status

sudo systemctl status tailscaled

View Logs

sudo journalctl -u tailscaled -f

Re-authenticate

If the node is not connecting:

sudo tailscale up --login-server=https://headscale.cryodev.xyz --force-reauth

Node Not Appearing in Headscale

Check the auth key is valid:

# On Headscale server
sudo headscale preauthkeys list --user <ID>

Verify the login server URL is correct in the client configuration.