Tailscale
Mesh VPN for secure remote access built on WireGuard.
Official Documentation: https://tailscale.com
Deployment
Section titled “Deployment”auberge ansible run --tags tailscaleConfiguration
Section titled “Configuration”Enrollment keys are minted per run against self-hosted Headscale; tailscale_authkey in config.toml is a fallback for the host that serves it, and the source on a Tailscale SaaS tailnet. See Environment Variables.
Optional: DNS Automation
Section titled “Optional: DNS Automation”Setting tailscale_api_key in config.toml enables automated DNS configuration. The Blocky role uses this key to register itself as the tailnet DNS nameserver via the Tailscale API, routing all tailnet client DNS queries through Blocky for ad-blocking.
See Blocky - Required config for details.
Server DNS Behavior
Section titled “Server DNS Behavior”The server runs with accept_dns: false (the default) to prevent Tailscale from overriding the server’s own DNS resolution. This avoids DNS breakage during redeployments — if the server accepted Tailscale DNS pointing at its own Blocky instance, a Blocky restart would break DNS resolution for the server itself.
Exit Node
Section titled “Exit Node”An exit node lets a device send all its traffic through the host, so a phone on public WiFi egresses from the host’s public IP.
auberge host edit aubergeauberge config set hosts.auberge.tailscale_advertise_exit_node trueEither form writes tailscale_advertise_exit_node = true under [hosts.auberge]: host edit asks for it interactively, config set is the one-liner.
Deploy with auberge ansible run --tags tailscale. On the host this enables IPv4 and IPv6 forwarding, sets rp_filter = 2 (strict filtering drops forwarded packets), and allows routed traffic from tailscale0 in UFW. With Headscale, the route is auto-approved for tag:data hosts and tag:trusted devices may use it.
Advertising is permanent; using it is per device. In the Tailscale app, pick the host under Exit node, or None to return to split-tunnel. Reverting the flag removes the sysctl drop-in, but the kernel keeps the values until reboot.
Self-Hosted Control Server
Section titled “Self-Hosted Control Server”To replace Tailscale SaaS with a self-hosted control plane, see Headscale. Set tailscale_login_server in config.toml to point nodes at your Headscale instance.