hermes-skills/skills/devops/infrastructure-automation/references/tailscale-infrastructure-access.md

Tailscale Infrastructure Access

Standard for accessing servers and services that don't need public internet exposure. All IT Pro Partner infrastructure joins the same tailnet.

Installation (server side)

curl -fsSL https://tailscale.com/install.sh | sh
tailscale up

This prints a one-time auth URL. Send it to the user to open in their browser. The command times out after 15s if the URL isn't opened — that's expected, the URL is still valid. Re-run tailscale up for a fresh URL if needed.

Rename the hostname from the auto-generated to a clean name:

tailscale set --hostname <name>

Installation (client devices)

Device	Download
macOS	tailscale.com/download-mac
iPhone/iPad	App Store → "Tailscale"
Linux	curl -fsSL https://tailscale.com/install.sh | sh

Sign in with the same Google account on every device. Devices auto-discover.

Post-setup verification

tailscale status               # list all connected devices
tailscale ip -4                # get this box's tailscale IP

Tailscale-only service access (with HTTPS)

For Vaultwarden and other internal-only services:

# Expose a local Docker port via Tailscale HTTPS
tailscale serve --bg --https 443 --set-path / http://127.0.0.1:<port>

# Verify
tailscale serve status
# → https://<hostname>.tail<random>.ts.net/ → proxy http://127.0.0.1:<port>

The .ts.net URL has a valid auto-TLS certificate. Only reachable from tailnet devices.

UFW rules

Creating a Tailscale-only service is a multi-step process — don't close the UFW port until the Tailscale Serve is verified:

ufw allow <port>/tcp comment 'temp'    # step 1: open for testing
# ... test Tailscale access ...
ufw delete allow <port>/tcp            # step 2: close when verified
ufw reload

For services that must also be accessible locally (SSH, HTTP management), keep those ports open.

Renaming a Tailscale node

tailscale set --hostname <new-name>
# Takes effect immediately in status and admin console
# Taliscale Serve: turn off and re-enable to pick up the new hostname

Important: if the auto-generated hostname has confusable characters (0 vs O), rename before deploying services. Some mobile apps (Bitwarden) silently corrupt zero characters in URL text fields.

Pitfalls

• tailscale up times out after 15s — expected. The URL stays valid.
• The 100.x.x.x IP can change on re-authentication. Use the .ts.net hostname for stable references.
• After a reboot, run tailscale up again.
• UFW does NOT auto-deny — new ports are public unless explicitly blocked. For tailnet-only services, verify with ufw status.
• Safari on iOS/Mac shows "Not Secure" on HTTP over tailnet — cosmetic. Use Tailscale Serve HTTPS for browser-based services.