Tailscale on the host
Tailscale on the host: a first setup, important settings, verification, and recovery considerations.
Working directory: ~/homelab/core/vpn. Follow the common setup workflow first. This is a setup note based on the linked documentation, not a copy of my live configuration or a runtime verification of this full stack.
Start here
This entry is a host service, not a Compose container. Tailscale connects approved devices through a private network. Follow the official Linux package instructions on your practice server and install the client on your own computer. Keep the server console available during initial setup.
Settings and data
Join your own tailnet and review its access policy before assuming devices are isolated. Permit only the users, devices, and ports needed. Do not enable subnet routing, an exit node, or public sharing just to reach one host. Those are distinct capabilities with wider consequences.
Check it
Use tailscale status on the host and test the chosen service from an allowed device. Also test denial from a device or identity outside the rule. A service bound only to loopback is not directly reachable over the VPN; keep the tutorial's SSH forward or deliberately redesign its listener.
When something fails
If the peer appears offline, check the daemon, sign-in state, time, and internet access. If the peer is reachable but the app is not, inspect policy, listener, and host firewall separately. Keep enrollment keys out of Git and screenshots. Document device removal and recovery if your identity provider is unavailable.
Run this only after the setup above, from its project directory:
tailscale status