Tailscale Field Guide

Recipes

Cool things a tailnet lets you do.

The curriculum explains the machine and the drills investigate it when it breaks. These are the things worth building once you trust it: each one is a complete recipe with the mechanism, the commands, how to prove it works, and the traps. Two come from running a small fleet every day. The rest are capabilities most tailnets never switch on.

What these recipes change about a network configure each new box machines arrive enrolled remember which host the fleet acts as one machine open ports, forward, hope publish without exposure copy keys around policy decides, with receipts run a daemon beside the app the program is the node

7 recipes · 2 intermediate · 5 advanced

  1. 01 Make every new VM join the tailnet before you ever log in New machines arrive already on the tailnet, already firewalled, with no manual step and no window of exposure. A first boot script that enrolls a fresh cloud VM, then locks ingress to the tailnet only, so the box is never reachable from the public internet at any point in its life. advanced
  2. 02 Stop typing hostnames and treat the whole fleet as one machine You think in projects instead of hosts, and long running work survives reboots on every machine at once. A project picker that spans every machine on the tailnet, jumping you into persistent sessions locally or over SSH without you ever naming a host, plus fan out to run one command everywhere. intermediate
  3. 03 Receive real webhooks straight onto your dev box A stable public HTTPS endpoint on hardware you own, with a publicly trusted certificate, from one command. Expose one path of a local development server to the public internet over HTTPS with Tailscale Funnel, so webhook senders deliver to your own machine with no third party tunnel service and no rotating URL. intermediate
  4. 04 Replace SSH keys with identity, then record the sessions No authorized_keys to manage, a fresh identity proof before every privileged login, and a greppable recording of what was typed. Run Tailscale SSH with no key distribution, force re-authentication at the door of sensitive hosts with action check, and stream privileged sessions to a recorder node so they can be audited afterward. advanced
  5. 05 Put your access policy in git and let tests block the bad merge A policy change that would lock you out of your own network fails a check instead of taking effect. Move the tailnet policy file out of the admin console into a git repository where every change arrives as a reviewable diff and an automated check refuses to ship a policy that would remove access to something you cannot afford to lose. advanced
  6. 06 Give a SaaS vendor one address to allowlist, from anywhere The vendor's IP allowlist stays one line long no matter where anyone opens their laptop. Use an app connector so traffic to a specific vendor's domains leaves your tailnet from a single stable public address, while everything else on the device keeps going out directly. advanced
  7. 07 Put a tailnet node inside your Go binary A service reachable only over your tailnet, that knows exactly who is calling it, from a single static binary. Use tsnet to embed a full Tailscale node in a Go program so the process itself joins the tailnet, with no daemon, no sidecar, no root, and no host networking. advanced