vault-sync: 2026-09-13 12:07 (jimmy)

2026-09-13 12:07:23 -07:00
parent e918f23707
commit aa52eecb5c
50 changed files with 4101 additions and 103 deletions
@@ -0,0 +1,67 @@
+---
+title: Tailscale / Headscale Cheat Sheet
+date: 2026-09-05
+type: reference
+tags: [tailscale, headscale, vps, network, ops]
+source: ~/src/Tailscale-configs/README.md
+---
+
+# Tailscale / Headscale — Cheat Sheet
+
+Homegrown copy of the repo README (`~/src/Tailscale-configs/README.md`) for vault reference. Join/rotate **keys live in the repo's `tailscale_preauth_keys.md` — never in the vault.**
+
+Private Headscale tailnet (`ai-lab.tailnet`). Control plane is **HTTP** on `http://74.208.111.99:8443`. Do not use `https://` on that port.
+
+- **Users:** HS_ty (1), HS_tony (2), HS_shared (3)
+- **Nodes:** ubuntu `100.64.0.1` (VPS, HS_shared) · deepblueubu `100.64.0.2` (HS_ty) · desktop-81cbtv2 `100.64.0.4` (HS_tony) · tyubumini `100.64.0.5` (HS_ty)
+- **DNS base domain:** `ai-lab.tailnet` (MagicDNS enabled)
+
+## CLI Management (run on the VPS)
+```bash
+docker exec headscale headscale nodes list
+docker exec headscale headscale users list
+docker exec headscale headscale preauthkeys list
+docker exec headscale headscale preauthkeys create --user=HS_tony --reusable --expiration=87600h
+docker exec headscale headscale exit-node reset --node=NodeName
+docker exec headscale headscale rename NodeName --new-name=NewName
+docker logs headscale --tail 50
+```
+
+## Linux Client (run on the node, **not** the VPS; needs sudo)
+Remote nodes use HTTP `http://74.208.111.99:8443`. The VPS itself uses `http://127.0.0.1:8443`. Do **not** use `--force-reauth`.
+```bash
+tailscale status
+tailscale ip -4
+tailscale ping --c 3 100.64.0.1                 # flag is --c, not --ping-count
+sudo systemctl restart tailscaled && sleep 4 && tailscale status   # clears 1.98.x sticky-TLS hang
+sudo tailscale up --login-server=http://74.208.111.99:8443         # reconnect if offline but logged in
+sudo tailscale logout                            # then rejoin with the HS_* line from keys file
+sudo tailscale up --login-server=http://74.208.111.99:8443 --auth-key=<key>
+```
+
+## Windows Client (DESKTOP-81CBTV2, PowerShell **as Administrator**)
+`.\\tailscale` only works after `cd` to the install folder. No `--force-reauth` (hangs; doesn't rotate keys).
+```powershell
+cd "C:\Program Files\Tailscale"        # fallback: "C:\Program Files (x86)\Tailscale"
+.\tailscale status
+.\tailscale ip -4
+.\tailscale ping --c 3 100.64.0.1
+Restart-Service Tailscale; Start-Sleep -Seconds 4; .\tailscale status   # clears sticky-TLS hang
+.\tailscale up --login-server=http://74.208.111.99:8443                # reconnect if offline but logged in
+.\tailscale logout                        # then rejoin with the HS_tony join line
+.\tailscale up --login-server=http://74.208.111.99:8443 --auth-key=<key>
+```
+
+### Windows common errors
+- `.\tailscale` not recognized → `cd` into `C:\Program Files\Tailscale` first (or x86 path).
+- Must be PowerShell **as Administrator** (normal window can't restart the service / change state).
+- `--force-reauth` hangs (no browser / OIDC). Leave it off: restart the service, or `up` with the HTTP login-server.
+- `https://74.208.111.99:8443` fails (SSL / wrong version). Control plane is **HTTP**.
+- `--login-server=http://127.0.0.1:8443` on Windows does nothing useful — VPS-only address. Remotes must use `http://74.208.111.99:8443`.
+- Status LoggedOut → reconnect without a key won't finish. Logout then use the HS_tony join line.
+- Headscale shows node offline / last seen days ago → **ping the 100.64.x address first**; last-seen freezes when the map stream drops (not proof the peer is down).
+
+---
+## Related
+- [[Call-2026-08-15-Tony]] — Tailscale/Headscale repair session on the call
+- Repo (source of truth + keys): `~/src/Tailscale-configs/`