tailscale

The tailscale role installs Tailscale from the official apt repository, joins the host to your tailnet, and keeps the node’s preferences in sync with your variables.

What it does

Adds the Tailscale apt repository and installs tailscale, then starts tailscaled.
Enables IPv4 and IPv6 forwarding (/etc/sysctl.d/60-tailscale.conf) when tailscale_advertise_routes is not empty.
Joins the tailnet with tailscale up only when the node is not logged in yet. The auth key reaches Tailscale through a temporary file, never on the command line, and is not printed.
On later runs compares the node’s preferences with your variables and applies differences with tailscale set.

Key variables

Variable	Default	Meaning
`tailscale_auth_key`	empty	Used only while the node is not logged in. Keep it in a vault.
`tailscale_hostname`	`inventory_hostname_short`	Node name in the tailnet.
`tailscale_advertise_routes`	`[]`	Subnets this node routes into the tailnet.
`tailscale_accept_routes`	`false`	Use subnet routes advertised by other nodes.
`tailscale_accept_dns`	`false`	Let Tailscale manage DNS on this host.
`tailscale_advertise_tags`	`[]`	ACL tags (`tag:name`) advertised when the node joins.
`tailscale_ssh`	`false`	Enable Tailscale SSH.

All variables: tailscale in the reference.

Example

A subnet router for a private network:

- hosts: gateway
  become: true
  roles:
    - role: noixdev.infra.tailscale
      vars:
        tailscale_auth_key: "{{ vault_tailscale_auth_key }}"
        tailscale_advertise_routes: [192.0.2.0/24]
        tailscale_advertise_tags: ["tag:gateway"]

Gotchas

A node that is not logged in and has no tailscale_auth_key fails the run with a clear message. A node that is already logged in needs no key.
Approve advertised routes in the Tailscale admin console. Advertising a route is not enough; the tailnet only uses it once an admin approves it.
Tags are applied when the node joins. Changing tailscale_advertise_tags later needs a re-join; the role does not change them on a node that is already logged in.
tailscale_accept_dns is off by default, so the host’s own resolver keeps working. Turn it on only when you want MagicDNS on the host.
Use the tailnet range in your allowlist. Tailscale addresses are in 100.64.0.0/10 (IPv4) and fd7a:115c:a1e0::/48 (IPv6); add them to security_allowlist if you manage hosts over Tailscale.