initial commit

2026-07-12 10:17:17 -04:00
commit dab5a4ebc6
1424 changed files with 330463 additions and 0 deletions
@@ -0,0 +1,32 @@
+# Agent-side auth workaround for tailscale up
+
+`tailscale up` blocks until browser auth completes. The agent can't visit the URL.
+
+## Symptom
+
+```
+sudo tailscale up
+# prints: To authenticate, visit: https://login.tailscale.com/a/...
+# hangs forever → timeout after 60-300s
+```
+
+Each run generates a fresh URL. The URL from a previous run is stale.
+
+## Workflow that works
+
+1. `tailscale status` — confirms "Logged out" and prints the current auth URL
+2. Give the URL to the user
+3. `sudo tailscale up 2>&1` in background with `notify_on_complete=true, timeout=300`
+4. User authenticates in browser → process exits → agent notified
+
+## Why foreground fails
+
+Foreground `tailscale up` with timeout will always hit the timeout unless the user is fast. Background + notify_on_complete is the right pattern because the agent gets a push notification when auth completes, rather than polling or timing out.
+
+## Auth key alternative
+
+If the user has a pre-generated auth key from the Tailscale admin console:
+```bash
+sudo tailscale up --authkey tskey-client-<key>
+```
+This completes instantly with no browser step. Generate keys at https://login.tailscale.com/admin/settings/keys