The catalogue
Tailscale
The machine on your tailnet through an auth key: SSH and preview URLs from your phone or another computer, nothing exposed publicly. Lives beside Caddy or the tunnel.
- Module
- exposure.tailscale
- Category
- Exposure
What it installs
- Tailscale from the vendor’s own apt repository, key first, then the node joined to your tailnet with the auth key you give — on the command line tailscale takes it, replaced by [secret] in the journal.
- A ufw rule that lets the tailnet interface in, so SSH and the projects’ ports answer over Tailscale once the hardening has closed everything else.
What it asks you for
- An auth key minted in the Tailscale admin console, the name the machine takes on the tailnet if not its hostname, and whether Tailscale SSH opens the machine to tailnet members by their identity.
Good to know
The key is typed, not held by the app: it is minted for one machine and opens nothing from the laptop. The machine then keeps its own node key, and the dashboard says under which login it sits. Tailscale lives beside Caddy or the tunnel: it is the private way in, they are the public one. Tailscale SSH is off by default: it answers before sshd, so neither AllowUsers, nor root being closed, nor fail2ban applies to it, and only your tailnet’s access policy decides who gets in and as which account, root included. Uninstalling logs the node out of the tailnet before taking the package, the rule and the repository back.