ray
33 lines
1.2 KiB
Markdown
33 lines
1.2 KiB
Markdown
# Agent-side auth workaround for tailscale up
|
|
|
|
`tailscale up` blocks until browser auth completes. The agent can't visit the URL.
|
|
|
|
## Symptom
|
|
|
|
```
|
|
sudo tailscale up
|
|
# prints: To authenticate, visit: https://login.tailscale.com/a/...
|
|
# hangs forever → timeout after 60-300s
|
|
```
|
|
|
|
Each run generates a fresh URL. The URL from a previous run is stale.
|
|
|
|
## Workflow that works
|
|
|
|
1. `tailscale status` — confirms "Logged out" and prints the current auth URL
|
|
2. Give the URL to the user
|
|
3. `sudo tailscale up 2>&1` in background with `notify_on_complete=true, timeout=300`
|
|
4. User authenticates in browser → process exits → agent notified
|
|
|
|
## Why foreground fails
|
|
|
|
Foreground `tailscale up` with timeout will always hit the timeout unless the user is fast. Background + notify_on_complete is the right pattern because the agent gets a push notification when auth completes, rather than polling or timing out.
|
|
|
|
## Auth key alternative
|
|
|
|
If the user has a pre-generated auth key from the Tailscale admin console:
|
|
```bash
|
|
sudo tailscale up --authkey tskey-client-<key>
|
|
```
|
|
This completes instantly with no browser step. Generate keys at https://login.tailscale.com/admin/settings/keys
|