---
title: Tailscale / Headscale Cheat Sheet
date: 2026-09-05
type: reference
tags: [tailscale, headscale, vps, network, ops]
source: ~/src/Tailscale-configs/README.md
---

# Tailscale / Headscale — Cheat Sheet

Homegrown copy of the repo README (`~/src/Tailscale-configs/README.md`) for vault reference. Join/rotate **keys live in the repo's `tailscale_preauth_keys.md` — never in the vault.**

Private Headscale tailnet (`ai-lab.tailnet`). Control plane is **HTTP** on `http://74.208.111.99:8443`. Do not use `https://` on that port.

- **Users:** HS_ty (1), HS_tony (2), HS_shared (3)
- **Nodes:** ubuntu `100.64.0.1` (VPS, HS_shared) · deepblueubu `100.64.0.2` (HS_ty) · desktop-81cbtv2 `100.64.0.4` (HS_tony) · tyubumini `100.64.0.5` (HS_ty)
- **DNS base domain:** `ai-lab.tailnet` (MagicDNS enabled)

## CLI Management (run on the VPS)
```bash
docker exec headscale headscale nodes list
docker exec headscale headscale users list
docker exec headscale headscale preauthkeys list
docker exec headscale headscale preauthkeys create --user=HS_tony --reusable --expiration=87600h
docker exec headscale headscale exit-node reset --node=NodeName
docker exec headscale headscale rename NodeName --new-name=NewName
docker logs headscale --tail 50
```

## Linux Client (run on the node, **not** the VPS; needs sudo)
Remote nodes use HTTP `http://74.208.111.99:8443`. The VPS itself uses `http://127.0.0.1:8443`. Do **not** use `--force-reauth`.
```bash
tailscale status
tailscale ip -4
tailscale ping --c 3 100.64.0.1                 # flag is --c, not --ping-count
sudo systemctl restart tailscaled && sleep 4 && tailscale status   # clears 1.98.x sticky-TLS hang
sudo tailscale up --login-server=http://74.208.111.99:8443         # reconnect if offline but logged in
sudo tailscale logout                            # then rejoin with the HS_* line from keys file
sudo tailscale up --login-server=http://74.208.111.99:8443 --auth-key=<key>
```

## Windows Client (DESKTOP-81CBTV2, PowerShell **as Administrator**)
`.\\tailscale` only works after `cd` to the install folder. No `--force-reauth` (hangs; doesn't rotate keys).
```powershell
cd "C:\Program Files\Tailscale"        # fallback: "C:\Program Files (x86)\Tailscale"
.\tailscale status
.\tailscale ip -4
.\tailscale ping --c 3 100.64.0.1
Restart-Service Tailscale; Start-Sleep -Seconds 4; .\tailscale status   # clears sticky-TLS hang
.\tailscale up --login-server=http://74.208.111.99:8443                # reconnect if offline but logged in
.\tailscale logout                        # then rejoin with the HS_tony join line
.\tailscale up --login-server=http://74.208.111.99:8443 --auth-key=<key>
```

### Windows common errors
- `.\tailscale` not recognized → `cd` into `C:\Program Files\Tailscale` first (or x86 path).
- Must be PowerShell **as Administrator** (normal window can't restart the service / change state).
- `--force-reauth` hangs (no browser / OIDC). Leave it off: restart the service, or `up` with the HTTP login-server.
- `https://74.208.111.99:8443` fails (SSL / wrong version). Control plane is **HTTP**.
- `--login-server=http://127.0.0.1:8443` on Windows does nothing useful — VPS-only address. Remotes must use `http://74.208.111.99:8443`.
- Status LoggedOut → reconnect without a key won't finish. Logout then use the HS_tony join line.
- Headscale shows node offline / last seen days ago → **ping the 100.64.x address first**; last-seen freezes when the map stream drops (not proof the peer is down).

---
## Related
- [[Call-2026-08-15-Tony]] — Tailscale/Headscale repair session on the call
- Repo (source of truth + keys): `~/src/Tailscale-configs/`