personal-agent-os/memory-systems/agent-os/20_Areas/VPS/Tailscale-Headscale-Cheatsheet.md

title, date, type, tags, source

title	date	type	tags	source
Tailscale / Headscale Cheat Sheet	2026-09-05	reference	tailscale headscale vps network ops	~/src/Tailscale-configs/README.md

Tailscale / Headscale — Cheat Sheet

Homegrown copy of the repo README (~/src/Tailscale-configs/README.md) for vault reference. Join/rotate keys live in the repo's tailscale_preauth_keys.md — never in the vault.

Private Headscale tailnet (ai-lab.tailnet). Control plane is HTTP on http://74.208.111.99:8443. Do not use https:// on that port.

• Users: HS_ty (1), HS_tony (2), HS_shared (3)
• Nodes: ubuntu 100.64.0.1 (VPS, HS_shared) · deepblueubu 100.64.0.2 (HS_ty) · desktop-81cbtv2 100.64.0.4 (HS_tony) · tyubumini 100.64.0.5 (HS_ty)
• DNS base domain: ai-lab.tailnet (MagicDNS enabled)

CLI Management (run on the VPS)

docker exec headscale headscale nodes list
docker exec headscale headscale users list
docker exec headscale headscale preauthkeys list
docker exec headscale headscale preauthkeys create --user=HS_tony --reusable --expiration=87600h
docker exec headscale headscale exit-node reset --node=NodeName
docker exec headscale headscale rename NodeName --new-name=NewName
docker logs headscale --tail 50

Linux Client (run on the node, not the VPS; needs sudo)

Remote nodes use HTTP http://74.208.111.99:8443. The VPS itself uses http://127.0.0.1:8443. Do not use --force-reauth.

tailscale status
tailscale ip -4
tailscale ping --c 3 100.64.0.1                 # flag is --c, not --ping-count
sudo systemctl restart tailscaled && sleep 4 && tailscale status   # clears 1.98.x sticky-TLS hang
sudo tailscale up --login-server=http://74.208.111.99:8443         # reconnect if offline but logged in
sudo tailscale logout                            # then rejoin with the HS_* line from keys file
sudo tailscale up --login-server=http://74.208.111.99:8443 --auth-key=<key>

Windows Client (DESKTOP-81CBTV2, PowerShell as Administrator)

.\\tailscale only works after cd to the install folder. No --force-reauth (hangs; doesn't rotate keys).

cd "C:\Program Files\Tailscale"        # fallback: "C:\Program Files (x86)\Tailscale"
.\tailscale status
.\tailscale ip -4
.\tailscale ping --c 3 100.64.0.1
Restart-Service Tailscale; Start-Sleep -Seconds 4; .\tailscale status   # clears sticky-TLS hang
.\tailscale up --login-server=http://74.208.111.99:8443                # reconnect if offline but logged in
.\tailscale logout                        # then rejoin with the HS_tony join line
.\tailscale up --login-server=http://74.208.111.99:8443 --auth-key=<key>

Windows common errors

• .\tailscale not recognized → cd into C:\Program Files\Tailscale first (or x86 path).
• Must be PowerShell as Administrator (normal window can't restart the service / change state).
• --force-reauth hangs (no browser / OIDC). Leave it off: restart the service, or up with the HTTP login-server.
• https://74.208.111.99:8443 fails (SSL / wrong version). Control plane is HTTP.
• --login-server=http://127.0.0.1:8443 on Windows does nothing useful — VPS-only address. Remotes must use http://74.208.111.99:8443.
• Status LoggedOut → reconnect without a key won't finish. Logout then use the HS_tony join line.
• Headscale shows node offline / last seen days ago → ping the 100.64.x address first; last-seen freezes when the map stream drops (not proof the peer is down).

---

Related

• Call-2026-08-15-Tony — Tailscale/Headscale repair session on the call
• Repo (source of truth + keys): ~/src/Tailscale-configs/