Tailscale

https://tailscale.com/docs
Admin
Tailscale is a zero-trust networking platform that creates secure, encrypted networks using...
Tokens:1,872,311
Snippets:18,520
Trust Score:10
Update:13 hours ago
Show doc for...
Tokens:
Raw
### Run setup script with kind clusters

Source: https://tailscale.com/docs/kubernetes-operator/quickstart

Run this command from the repository root to create two local kind clusters and install the Tailscale operator. Requires kind to be installed.

```shell
./00-setup.sh
```

--------------------------------

### Start a basic web server with http-server on port 8080

Source: https://tailscale.com/docs/features/tailscale-services

Install the http-server package globally and start a web server that serves static files from the current directory on port 8080. Use this to have a resource running before configuring it as a Service host.

```shell
# Install globally
npm install -g http-server

# Then start a basic web server
http-server -p 8080
```

--------------------------------

### Get help for tailzero start

Source: https://tailscale.com/docs/privileged-access-management/reference/tailzero

Run this command to display help for the tailzero start command.

```shell
tailzero start -h
```

--------------------------------

### Verify Aperture CLI installation

Source: https://tailscale.com/docs/aperture/cli

Run this command to verify that the Aperture CLI is installed and accessible. It attempts to connect and displays the main menu or a setup guide.

```shell
aperture
```

--------------------------------

### Download and extract getting-started scripts and manifests

Source: https://tailscale.com/docs/kubernetes-operator/quickstart

Run this command to download and extract the getting-started directory containing step scripts and Kubernetes manifests used throughout the quickstart.

```shell
curl -sL https://tailscale.com/k8s/getting-started.tar.gz | tar xz
cd getting-started
```

--------------------------------

### Set up Go environment

Source: https://tailscale.com/docs/solutions/connect-github-cicd-workflows-to-private-infrastructure-without-public-exposure

This step uses the actions/setup-go@v5 action to install Go version 1.23, ensuring the runner has the correct toolchain for building and testing your application.

```yaml
    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: '1.23'
```

--------------------------------

### Example PAM grant for database access

Source: https://tailscale.com/docs/privileged-access-management/how-to/access-database/amazon-rds?tab=username+and+password

This grant permits any source to connect to PAM database services. It is a broad grant useful for getting started, but in production you can restrict the src and dst fields.

```json
"grants": [
  {
    "src": ["*"],
    "dst": ["*"],
    "ip": ["*"],

    "app": {
      "tailscale.com/cap/pam": [
        {
          "version": "v1",

          "permissions": {
            "database": {}
          }
        }
      ]
    }
  }
]
```

--------------------------------

### Grant access to PAM RDP services

Source: https://tailscale.com/docs/privileged-access-management/how-to/access-windows-server-rdp

Example grant that permits any source to connect to PAM RDP services. This is a broad grant useful for getting started; in production, restrict the src and dst fields.

```json
"grants": [
  {
    "src": ["*"],
    "dst": ["*"],
    "ip": ["*"],

    "app": {
      "tailscale.com/cap/pam": [
        {
          "version": "v1",

          "permissions": {
            "rdp": {}
          }
        }
      ]
    }
  }
]
```

--------------------------------

### Example prompt: Configure exit node on Ubuntu server

Source: https://tailscale.com/docs/features/tailscale-skill

Explicitly invokes the Tailscale Skill to configure a feature on the current device. Use this prompt to set up an exit node and advertise it.

```markup
/tailscale Configure this Ubuntu server as an exit node and advertise it.
```

--------------------------------

### Start and verify Tailscale daemon

Source: https://tailscale.com/docs/install/opnsense

Enable and start the tailscaled daemon, then verify the installed version.

```shell
# service tailscaled enable
# service tailscaled start
# tailscale version
root@opnsense:~ # tailscale version
1.56.1
  go version: go1.21.5
```

--------------------------------

### Initialize tsnet.Server and listen on address

Source: https://tailscale.com/docs/features/tsnet

Create a tsnet.Server with a hostname, start it, and listen on a TCP address to accept connections from your tailnet. The example uses flag package for configuration and defers cleanup.

```go
var (
	addr     = flag.String("addr", ":80", "address to listen on")
	hostname = flag.String("hostname", "tshello", "hostname to use in the tailnet")
)

func main() {
	flag.Parse()
	srv := new(tsnet.Server)
	srv.Hostname = *hostname
	if err := srv.Start(); err != nil {
		log.Fatalf("can't start tsnet server: %v", err)
	}
	defer srv.Close()

	ln, err := srv.Listen("tcp", *addr)
	if err != nil {
		log.Fatalf("can't listen: %v", err)
	}
	defer ln.Close()

	// Use ln to serve requests to your tailnet
    ...
}
```

--------------------------------

### Initialize a Go program

Source: https://tailscale.com/docs/features/tsnet/how-to/create-basic-tsnet-app

At a command line, initialize a Go program.

```shell
go mod init tshello
```

--------------------------------

### Example output of kubectl get ingress

Source: https://tailscale.com/docs/kubernetes-operator/ingress/expose-workload-to-tailnet-l7.md

Shows the output of the kubectl get ingress command, including the MagicDNS name in the ADDRESS field.

```text
NAME               CLASS       HOSTS   ADDRESS                     PORTS   AGE
nginx-ha-ingress   tailscale   *       nginx-ha.tailxxxxx.ts.net   443     1m
```

--------------------------------

### Example Tailscale Ingress and Service YAML

Source: https://tailscale.com/docs/kubernetes-operator/reference/troubleshooting

Example configuration for a Tailscale Ingress with a backend Service. Use this as a reference when troubleshooting your own Ingress setup.

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-app
spec:
  ingressClassName: tailscale
  rules:
    - http:
        paths:
          - backend:
              service:
                name: my-app
                port:
                  number: 80
            path: /login
            pathType: Prefix
  tls:
    - hosts:
        - my-app
---
apiVersion: v1
kind: Service
metadata:
  name: my-app
spec:
  clusterIP: 192.0.2.9
  ports:
    - port: 80
```

--------------------------------

### Install Tailscale and enable SSH on a server

Source: https://tailscale.com/docs/use-cases/infrastructure-access/record-ssh-sessions-compliance

Run these commands on each server you want to record. The first command installs the Tailscale client, and the second enables the built-in SSH server. Repeat on every server you want to record.

```bash
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --ssh
```

--------------------------------

### Example output of kubectl get service nginx-service

Source: https://tailscale.com/docs/kubernetes-operator/ingress/expose-workload-to-tailnet-l3

The output displays with an IP address in the `EXTERNAL-IP` column.

```markup
NAME            TYPE           CLUSTER-IP       EXTERNAL-IP       PORT(S)        AGE
nginx-service   LoadBalancer   34.118.238.206   100.102.116.165   80:30162/TCP   3m26s
```

--------------------------------

### Install Tailscale MSI using msiexec

Source: https://tailscale.com/docs/install/windows/msi

Run the installer using the msiexec command. Replace <path_to_tailscale_msi.msi> with the actual path to the downloaded MSI file.

```powershell
msiexec /i <path_to_tailscale_msi.msi>
```
Tokens:
Raw