### Download and Extract Getting Started Scripts Source: https://tailscale.com/docs/kubernetes-operator/quickstart Download and extract the necessary scripts and manifests for the Tailscale Kubernetes Operator quickstart. Navigate into the extracted directory to proceed. ```bash curl -sL https://tailscale.com/k8s/getting-started.tar.gz | tar xz cd getting-started ``` -------------------------------- ### Install and Start Tailscale Client Source: https://tailscale.com/docs/install/cloud/hetzner Installs the Tailscale client on a Hetzner VM and then starts the service. Ensure you have a Tailscale network set up prior to this step. ```bash # curl -fsSL https://tailscale.com/install.sh | sh # tailscale up ``` -------------------------------- ### Install Tailscale Startup Script for Systemd Source: https://tailscale.com/docs/reference/tailscale-cli?tab=macos Installs the startup script for the systemd init system to ensure Tailscale starts on boot. ```bash tailscale systray --enable-startup=systemd ``` -------------------------------- ### Start the Systray Application Source: https://tailscale.com/docs/features/client/linux-systray Run the systray application from the command line. Ensure Tailscale is installed and accessible in your PATH. ```bash tailscale systray ``` -------------------------------- ### Run Setup Script with Kind Source: https://tailscale.com/docs/kubernetes-operator/quickstart Use this script to automatically create and configure two local kind clusters with the Tailscale Kubernetes Operator installed. ```bash ./00-setup.sh ``` -------------------------------- ### Install code-server Script Source: https://tailscale.com/docs/solutions/code-on-ipad-vscode-caddy-code-server Installs code-server using the official installation script. This is the initial step for setting up the environment. ```bash curl -fsSL https://code-server.dev/install.sh | sh ``` -------------------------------- ### Initialize Go module and get tsnet Source: https://tailscale.com/docs/solutions/connect-github-CICD-workflows-to-private-infrastructure-without-public-exposure Initializes a new Go module for the tshello project and installs the tailscale.com/tsnet package. ```bash go mod init tshello go get tailscale.com/tsnet ``` -------------------------------- ### Install http-server Package Source: https://tailscale.com/docs/features/tailscale-services Install the http-server package globally using npm. This is a prerequisite for running a basic web server example. ```bash # Install globally npm install -g http-server ``` -------------------------------- ### Start and Verify Tailscale Service Source: https://tailscale.com/docs/install/opnsense Enables the tailscaled daemon to start on boot, starts the service immediately, and then checks the installed Tailscale version. This confirms the installation was successful. ```bash # service tailscaled enable # service tailscaled start # tailscale version root@opnsense:~ # tailscale version 1.56.1 go version: go1.21.5 ``` -------------------------------- ### Kubernetes Ingress and Service Example Source: https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator Example Kubernetes Ingress and Service definitions for a Tailscale Ingress setup. ```yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: my-app spec: ingressClassName: tailscale rules: - http: paths: - backend: service: name: my-app port: number: 80 path: /login pathType: Prefix tls: - hosts: - my-app --- apiVersion: v1 kind: Service metadata: name: my-app spec: clusterIP: 192.0.2.9 ports: - port: 80 ``` -------------------------------- ### Complete Aperture Configuration Example Source: https://tailscale.com/docs/aperture/configuration This example demonstrates a full Aperture configuration, including grants for access control, spending limits, S3 exporter settings, LLM provider definitions, chat model curation, hook configurations, MCP server proxying, and database settings. Use this as a template for your own setup. ```json { // Access control: who can use which models "grants": [ // All users: access all models with per-user and org-wide quotas { "src": ["*"], "app": { "tailscale.com/cap/aperture": [ { "role": "user" }, { "models": "**", "quotas": [ {"bucket": "daily:"}, {"bucket": "org-monthly"}, ], }, ], }, }, // Admin access for specific user with audit hook { "src": ["admin@company.com"], "app": { "tailscale.com/cap/aperture": [ { "role": "admin" }, { "models": "**", "send_hooks": [ { "name": "oso", "events": ["tool_call_entire_request"], "send": ["tools", "estimated_cost"], }, ], }, ], }, }, // CORS headers for browser-based clients { "src": ["browser-app@example.com"], "app": { "tailscale.com/cap/aperture": [ { "set_cors": true, "cors_paths": ["/v1/**", "/bedrock/**"], "Access-Control-Allow-Origin": "https://app.example.com", "Access-Control-Allow-Methods": "POST, OPTIONS", "Access-Control-Allow-Headers": "Content-Type, Authorization", }, ], }, }, ], // Dollar-based spending limits "quotas": { "daily:": { "capacity": "$10.00", "rate": "$5.00/day", "on_exceed": "reject", }, "org-monthly": { "capacity": "$2000.00", "rate": "$2000.00/month", "on_exceed": "reject", }, }, // LLM session log export configuration "exporters": { "s3": { // Required for S3-compatible services (GCS, MinIO, Backblaze B2, and others) "endpoint": "https://your-s3-compatible-endpoint.url", "bucket_name": "aperture-exports", "region": "us-west-2", "prefix": "prod", "access_key_id": "", "access_secret": "", "every": 3600, "limit": 1000 } }, // LLM providers "providers": { "openai": { "baseurl": "https://api.openai.com", "apikey": "", "models": ["gpt-5.5", "gpt-5.4-mini", "gpt-5.4"], "name": "OpenAI", "description": "OpenAI models for coding and chat", "compatibility": { "openai_chat": true, "openai_responses": true } }, "anthropic": { "baseurl": "https://api.anthropic.com", "apikey": "", "authorization": "x-api-key", "models": ["claude-sonnet-4-6", "claude-haiku-4-5", "claude-opus-4-7"], "name": "Anthropic", "compatibility": { "openai_chat": false, "anthropic_messages": true } }, "gemini": { "baseurl": "https://generativelanguage.googleapis.com", "apikey": "", "authorization": "x-goog-api-key", "models": ["gemini-2.5-flash", "gemini-2.5-pro"], "name": "Google Gemini", "compatibility": { "openai_chat": false, "gemini_generate_content": true } }, "private": { "baseurl": "", "models": ["qwen3-coder-30b"] } }, // Chat UI model picker curation "chat_models": [ {"model": "anthropic/claude-opus-4-7", "display_name": "Opus 4.7", "priority": 100}, {"model": "anthropic/claude-sonnet-4-6", "display_name": "Sonnet 4.6", "priority": 90}, {"model": "anthropic/claude-haiku-4-5", "display_name": "Haiku 4.5", "priority": 70, "title_gen": true, "summarize": true}, {"model": "openai/gpt-5*", "priority": 50}, ], // Hooks for external integrations "hooks": { "oso": { "url": "https://api.osohq.com/api/agents/v1/model-request", "apikey": "", }, }, // MCP server proxying "mcp": { "accept_registrations": true, "servers": { "tools": { "url": "http://mcp-tools.example.ts.net:8080/v1/mcp", }, }, }, // Data storage settings "database": { "save_raws": false, "keep_encrypted_blobs": false, "retention": { "duration": "30d", "require_export": false, "purge": ["captures"], }, }, } ``` -------------------------------- ### Example Ingress Output Source: https://tailscale.com/docs/kubernetes-operator/ingress/expose-workload-to-internet Example output from 'kubectl get ingress', showing the MagicDNS address assigned to the exposed service. ```text NAME CLASS HOSTS ADDRESS PORTS AGE nginx-ha-ingress tailscale * nginx-public.tailxxxxx.ts.net 80 1m ``` -------------------------------- ### File Server Example Source: https://tailscale.com/docs/reference/tailscale-cli/serve Serve files or directories using tailscale serve by providing an absolute path to the file or directory. This option may have limitations on macOS depending on the installation method. ```bash tailscale serve /home/alice/blog/index.html ``` -------------------------------- ### Install Tailscale on Ubuntu Source: https://tailscale.com/docs/how-to/secure-ubuntu-server-with-ufw Install the Tailscale client on your Ubuntu server using the provided script. This command downloads and executes the official installation script. ```bash curl -fsSL https://tailscale.com/install.sh | sh ``` -------------------------------- ### Run Setup Script with Existing Clusters Source: https://tailscale.com/docs/kubernetes-operator/quickstart Configure and install the Tailscale Kubernetes Operator on your existing Kubernetes clusters by specifying their kubectl contexts as environment variables. ```bash CLUSTER_1= CLUSTER_2= ./00-setup.sh ``` -------------------------------- ### Kubernetes Ingress and Service Configuration Example Source: https://tailscale.com/docs/kubernetes-operator/reference/troubleshooting Example Kubernetes Ingress and Service definitions for a Tailscale Ingress setup. Ensure your Ingress resource has the 'tailscale' ingressClassName and your Service is correctly defined. ```yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: my-app spec: ingressClassName: tailscale rules: - http: paths: - backend: service: name: my-app port: number: 80 path: /login pathType: Prefix tls: - hosts: - my-app --- apiVersion: v1 kind: Service metadata: name: my-app spec: clusterIP: 192.0.2.9 ports: - port: 80 ``` -------------------------------- ### Install DERP Server from Source Source: https://tailscale.com/docs/reference/derp-servers/custom-derp-servers Installs the latest DERP server binary using Go. Ensure you have Go installed and configured. ```bash go install tailscale.com/cmd/derper@latest ``` -------------------------------- ### Enable and Start Tailscale Service Source: https://tailscale.com/docs/install/amazon-linux-2 Enables the Tailscale daemon to start on boot and starts it immediately using systemctl. ```bash sudo systemctl enable --now tailscaled ``` -------------------------------- ### Start Tailscale Source: https://tailscale.com/docs/aperture/cli If Tailscale is not running, start the application or service on your machine. Then, log in using `tailscale up`. ```bash tailscale up ``` -------------------------------- ### Clone Tailscale Kubernetes Examples Source: https://tailscale.com/docs/kubernetes Clone the Tailscale Kubernetes examples repository to follow along with the documentation. ```bash gh repo clone tailscale/tailscale cd tailscale/docs/k8s ``` -------------------------------- ### Example Tailscale IP Addresses for Hostname Source: https://tailscale.com/docs/reference/tailscale-cli?tab=fish Example output showing both IPv4 and IPv6 addresses for a specified hostname. ```text 100.126.153.111 fd7a:115c:a1e0:ab12:4843:cd96:627e:9975 ``` -------------------------------- ### Start tsnet Server with Default Settings Source: https://tailscale.com/docs/reference/tsnet-server-api Initializes and starts a tsnet.Server with default configurations. Ensure to close the server when done using defer. ```Go srv := new(tsnet.Server) if err := srv.Start(); err != nil { log.Fatalf("can't start tsnet server: %v", err) } def srv.Close() ``` -------------------------------- ### Enable Systray Startup with Freedesktop Autostart Source: https://tailscale.com/docs/features/client/linux-systray Configure the systray application to launch on startup using a freedesktop autostart file. Requires Tailscale version 1.96 or later. ```bash tailscale configure systray --enable-startup=freedesktop ``` -------------------------------- ### Per-User Quota Example Source: https://tailscale.com/docs/aperture/configuration Example demonstrating a per-user quota configuration where each user has an independent spending limit. This setup creates a separate bucket for each user. ```json "quotas": { "daily:": { "capacity": "$10.00", "rate": "$5.00/day", "on_exceed": "reject", }, }, "grants": [ { "src": ["*"], "app": { "tailscale.com/cap/aperture": [ { "role": "user" }, { "models": "**", "quotas": [{"bucket": "daily:"}] }, ], }, }, ] ``` -------------------------------- ### Install Tailscale on OPNsense Source: https://tailscale.com/docs/install/opnsense These commands navigate to the Tailscale port directory and initiate the installation process. This is a required step after updating the ports tree. ```bash # cd /usr/ports/security/tailscale # make install ``` -------------------------------- ### Add Tailscale Repository and Install Source: https://tailscale.com/docs/install/centos/centos-8 Adds the official Tailscale repository for CentOS 8 and installs the Tailscale package. This is the first step to get Tailscale running on your system. ```bash sudo dnf config-manager --add-repo https://pkgs.tailscale.com/stable/centos/8/tailscale.repo sudo dnf install tailscale ``` -------------------------------- ### Create Files for File Server Example Source: https://tailscale.com/docs/reference/examples/funnel Creates a directory and two sample text files to be served by Tailscale Funnel. This is a prerequisite for the file server example. ```bash mkdir /tmp/public echo "Hello World" > /tmp/public/hello.txt echo "Pangolin" > /tmp/public/animal.txt ``` -------------------------------- ### Start tailscaled with Configuration File Source: https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file How to start the tailscaled daemon using a configuration file. The path must be specified explicitly using the --config flag. ```bash tailscaled --config=/etc/tailscale/config.json ``` -------------------------------- ### Start a Basic Web Server Source: https://tailscale.com/docs/features/tailscale-services Starts a basic HTTP server serving static files from the current directory on port 8080. This is a prerequisite for configuring it as a Tailscale Service host. ```bash http-server -p 8080 ``` -------------------------------- ### Tailscale Version Output Example Source: https://tailscale.com/docs/reference/tailscale-cli Example output when running the `tailscale version` command, showing the client version, commit hashes, and Go version. ```text tailscale version 1.72.0 tailscale commit: 9a0f00ea8ed08d1a94b357fb232ac9d44a512664 other commit: 387e0b40ad87031fb4444372ee80a97156e8deb9 go version: go1.22.5 ``` -------------------------------- ### Disable a Tailscale Serve command (HTTPS example) Source: https://tailscale.com/docs/reference/tailscale-cli/serve Turn off a previously started Tailscale Serve command. All original flags are required, and the target is optional. ```bash tailscale serve --https=443 /home/alice/blog/index.html off ``` -------------------------------- ### tsnet.Server Initialization and Start Source: https://tailscale.com/docs/reference/tsnet-server-api Demonstrates the basic initialization of a tsnet.Server and starting its connection to the Tailscale network. The server uses default settings until configured otherwise. Ensure to close the server when done. ```APIDOC ## tsnet.Server.Start ### Description Initializes and starts the tsnet server, establishing a connection to the Tailscale network. This method should be called after configuring server settings. ### Method `Start()` ### Parameters None ### Request Example ```go srv := new(tsnet.Server) if err := srv.Start(); err != nil { log.Fatalf("can't start tsnet server: %v", err) } defer srv.Close() ``` ### Response #### Success Response No explicit return value on success, but the server is started. #### Error Response Returns an error if the server fails to start. ``` -------------------------------- ### Create a sample index.html file Source: https://tailscale.com/docs/features/tailscale-funnel/how-to/host-websites This snippet shows the basic HTML structure for a test website. Save this content into a file named `index.html`. ```html Test Website

This is a heading

This is a paragraph

``` -------------------------------- ### Wait for Service Readiness Source: https://tailscale.com/docs/reference/tailscale-cli A common pattern for services to ensure Tailscale is ready before starting. This example shows how a service can wait for Tailscale to be online before executing its own commands. ```bash tailscale wait && /path/to/service [...] ``` -------------------------------- ### Disable a Tailscale Serve command (HTTPS with set-path example) Source: https://tailscale.com/docs/reference/tailscale-cli/serve Turn off a previously started Tailscale Serve command, demonstrating that the target argument can be omitted when disabling. ```bash tailscale serve --https=443 --set-path=/foo off ``` -------------------------------- ### Initialize and Start tsnet Server Source: https://tailscale.com/docs/features/tsnet Initialize a tsnet.Server with a listening address and hostname, then start it. Ensure to defer closing the server. ```go var ( addr = flag.String("addr", ":80", "address to listen on") hostname = flag.String("hostname", "tshello", "hostname to use in the tailnet") ) func main() { flag.Parse() srv := new(tsnet.Server) srv.Addr = *addr srv.Hostname = *hostname if err := srv.Start(); err != nil { log.Fatalf("can't start tsnet server: %v", err) } defer srv.Close() // Use the tsnet.Server object to interact with your tailnet ... } ``` -------------------------------- ### Tailscale CLI Tab Completion Setup Source: https://tailscale.com/docs/reference/tailscale-cli?tab=zsh Configure tab completion for the Tailscale CLI in your shell. This example shows the command to generate completion scripts for Zsh. ```zsh echo "autoload -U compinit; compinit" >> ~/.zshrc ``` ```zsh tailscale completion zsh > "${fpath[1]}/_tailscale" ``` -------------------------------- ### Get cluster's OIDC issuer URL Source: https://tailscale.com/docs/kubernetes-operator/manage-and-configure/workload-identity-federation Retrieve the cluster's OIDC issuer URL using kubectl and jq. Ensure jq is installed on your system. ```bash ISSUER="$(kubectl get --raw /.well-known/openid-configuration | jq '.issuer')" ``` -------------------------------- ### Direct Connection Example with `tailscale status` Source: https://tailscale.com/docs/reference/connection-types Examine `tailscale status` output to identify a direct connection. Look for the 'direct' keyword. ```bash 100.113.160.82 device-a tagged-devices linux active; offers exit node; direct 140.82.13.138:41641 ``` -------------------------------- ### Build and Run Systray from Source Source: https://tailscale.com/docs/features/client/linux-systray Build and run the systray application from source for unsupported operating systems or specific build requirements. Requires Go to be installed. ```bash go run tailscale.com/cmd/systray@latest ``` -------------------------------- ### Install Tailscale VPN Configuration Profile Source: https://tailscale.com/docs/integrations/mdm/mac This Property List (.plist) file configures the VPN connection before the Tailscale app launches, skipping the in-app setup. Adjust BundleIdentifier and ProviderBundleIdentifier for the Standalone variant if needed. ```plist PayloadDisplayName Tailscale VPN Configuration Profile PayloadType Configuration PayloadVersion 1 PayloadIdentifier com.your-company-name.tailscale.797d4461-837c-4f5a-b18e-7e300a057018 PayloadUUID 0f451881-7ac4-4171-80fd-b55251053231 PayloadContent PayloadDisplayName Tailscale VPN Configuration PayloadType com.apple.vpn.managed PayloadVersion 1 PayloadIdentifier com.your-company-name.tailscale-tunnel PayloadUUID 7ec957e2-b165-4d1f-9946-3a7a16ae0f9b UserDefinedName Tailscale MobileConfig VPNType VPN VPNSubType io.tailscale.ipn.macos VPN RemoteAddress Tailscale Mesh AuthenticationMethod Password ProviderBundleIdentifier io.tailscale.ipn.macos.network-extension ``` -------------------------------- ### Install ExternalDNS with Pi-hole Provider Source: https://tailscale.com/docs/solutions/kubernetes-operator-byod-gateway-api Deploys ExternalDNS using Helm, configured to use Pi-hole as the DNS provider. This setup manages DNS records for Gateway resources labeled for external DNS and filters domains to 'example.com'. ```bash helm repo add external-dns https://kubernetes-sigs.github.io/external-dns helm repo update helm install external-dns external-dns/external-dns \ --namespace tailscale \ --set provider=pihole \ --set 'extraArgs[0]=--pihole-server=http://pihole-web.tailscale' \ --set 'extraArgs[1]=--pihole-api-version=6' \ --set 'extraArgs[2]=--gateway-label-filter=external-dns==enabled' \ --set policy=sync \ --set 'sources[0]=gateway-httproute' \ --set 'domainFilters[0]=example.com' \ --set-string env[0].name=EXTERNAL_DNS_PIHOLE_PASSWORD \ --set env[0].valueFrom.secretKeyRef.name=pihole-admin \ --set env[0].valueFrom.secretKeyRef.key=password ``` -------------------------------- ### Start the tailscaled daemon with static binaries Source: https://tailscale.com/docs/install/linux After unpacking the static binaries, start the tailscaled daemon using this command. A service configuration for systemd is available in the 'systemd/' subdirectory if needed. ```bash sudo tailscaled --state=tailscaled.state ``` -------------------------------- ### Install Tailscale with MSI Source: https://tailscale.com/docs/install/windows/msi Use msiexec to install the Tailscale MSI package. You can optionally log the installation process to a file. ```bash msiexec /i ``` ```bash msiexec /L /i ``` -------------------------------- ### Enable Systray Startup with Systemd User Service Source: https://tailscale.com/docs/features/client/linux-systray Configure the systray application to launch on startup as a systemd user service. Requires Tailscale version 1.96 or later. ```bash tailscale configure systray --enable-startup=systemd ``` -------------------------------- ### Set up multiple app connectors Source: https://tailscale.com/docs/how-to/set-up-high-availability Run this command on multiple machines to create app connectors tagged for high availability. Ensure all app connectors share the same tag. ```bash sudo tailscale up --advertise-connector --advertise-tags="tag:connector" ``` -------------------------------- ### Install Claude Code Agent Source: https://tailscale.com/docs/aperture/cli Use this command to install the Claude Code agent. Ensure you have curl installed on your system. ```bash curl -fsSL https://claude.ai/install.sh | bash ``` -------------------------------- ### Install Tailscale Script Source: https://tailscale.com/docs/install/windows/wsl2 This command downloads and executes the automatic installation script for Tailscale on your WSL 2 instance. More detailed instructions, including a manual installation process, can be found on the Install Tailscale on Linux page. ```bash curl -fsSL https://tailscale.com/install.sh | sh ``` -------------------------------- ### Install curl on Debian Trixie Source: https://tailscale.com/docs/install/debian/debian-trixie Install the curl utility if it is not already present. This command updates the package list and then installs curl. ```bash apt-get update apt-get install curl ``` -------------------------------- ### Example output of 'tailscale drive list' Source: https://tailscale.com/docs/features/taildrive?tab=linux This is an example of the output format for the 'tailscale drive list' command, showing share names, paths, and associated users. ```text name path as ------ ---------------------- ---- nas /media/data-A/nas-data root docs /pi/docs root backup /pi/system-backups root ``` -------------------------------- ### Create tshello directory and navigate Source: https://tailscale.com/docs/solutions/connect-github-CICD-workflows-to-private-infrastructure-without-public-exposure Creates a new directory for the tshello application and changes the current directory into it. ```bash mkdir tshello cd tshello ``` -------------------------------- ### Enable and Start code-server Service Source: https://tailscale.com/docs/solutions/code-on-ipad-vscode-caddy-code-server Configures systemd to automatically start code-server on boot and immediately starts the service for the current user. ```bash sudo systemctl enable --now code-server@$USER ``` -------------------------------- ### Add Tailscale Repository and Install Source: https://tailscale.com/docs/install/fedora/fedora-2 Add the official Tailscale repository to your Fedora system and then install the Tailscale package. This is the first step in setting up Tailscale. ```bash sudo dnf config-manager addrepo --from-repofile=https://pkgs.tailscale.com/stable/fedora/tailscale.repo sudo dnf install tailscale ``` -------------------------------- ### ACL Example Source: https://tailscale.com/docs/reference/migrate-acls-grants An example of a standard ACL entry. ```json { "action": "accept", "src": ["group:eng"], "dst": ["tag:web-server:443"], "proto": "tcp" } ```