hermes-config/skills/devops/tailscale-remote-access/references/agent-auth-workaround.md

Agent-side auth workaround for tailscale up

tailscale up blocks until browser auth completes. The agent can't visit the URL.

Symptom

sudo tailscale up
# prints: To authenticate, visit: https://login.tailscale.com/a/...
# hangs forever → timeout after 60-300s

Each run generates a fresh URL. The URL from a previous run is stale.

Workflow that works

1. tailscale status — confirms "Logged out" and prints the current auth URL
2. Give the URL to the user
3. sudo tailscale up 2>&1 in background with notify_on_complete=true, timeout=300
4. User authenticates in browser → process exits → agent notified

Why foreground fails

Foreground tailscale up with timeout will always hit the timeout unless the user is fast. Background + notify_on_complete is the right pattern because the agent gets a push notification when auth completes, rather than polling or timing out.

Auth key alternative

If the user has a pre-generated auth key from the Tailscale admin console:

sudo tailscale up --authkey tskey-client-<key>

This completes instantly with no browser step. Generate keys at https://login.tailscale.com/admin/settings/keys