# Tailscale

> Tailscale mesh VPN integration for managing devices, SSH access, auth keys, ACLs, and DNS across your tailnet

- Skill: `arvo-ai/tailscale` (Agent Skill)
- Install (CLI): `npx skillmds@latest add arvo-ai/tailscale`
- Raw SKILL.md: https://api.skillmd.com/api/skills/arvo-ai/tailscale/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: Arvo-AI (https://skillmd.com/u/arvo-ai)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/arvo-ai/tailscale

---


# Tailscale Integration

## Overview
Tailscale is a mesh VPN/network provider. It connects your devices into a secure private network called a 'tailnet'.
Unlike cloud providers (GCP, AWS, Azure), Tailscale doesn't provision infrastructure - it networks existing devices.

## Instructions

### DEVICE MANAGEMENT
- List all devices: `cloud_exec('tailscale', 'device list')`
- Get device details: `cloud_exec('tailscale', 'device get <DEVICE_ID>')`
- Authorize a device: `cloud_exec('tailscale', 'device authorize <DEVICE_ID>')`
- Delete a device: `cloud_exec('tailscale', 'device delete <DEVICE_ID>')`
- Set device tags: `cloud_exec('tailscale', 'device tag <DEVICE_ID> tag:server')`

### SSH ACCESS (execute commands on devices)
- Run command on device: `tailscale_ssh('hostname', 'command', 'user')`
- Example - check uptime: `tailscale_ssh('myserver', 'uptime', 'root')`
- Example - docker status: `tailscale_ssh('web-prod', 'docker ps', 'admin')`
- Example - disk usage: `tailscale_ssh('database-1', 'df -h', 'ubuntu')`
- SETUP REQUIRED: User must add Aurora's SSH public key to target devices
  (Get key from Settings > Tailscale > SSH Setup)
- Targets must have SSH server running (Linux: sshd, macOS: Remote Login)
- If 'Permission denied' error: remind user to add Aurora's SSH key to the device

### AUTH KEYS (for adding devices programmatically)
- List auth keys: `cloud_exec('tailscale', 'key list')`
- Create auth key: `cloud_exec('tailscale', 'key create --ephemeral --reusable --tags tag:server')`
- Delete auth key: `cloud_exec('tailscale', 'key delete <KEY_ID>')`

### ACL (Access Control Lists)
- Get current ACL: `cloud_exec('tailscale', 'acl get')`
- Update ACL: `cloud_exec('tailscale', 'acl set <ACL_JSON>')`

### DNS & NETWORK
- Get DNS settings: `cloud_exec('tailscale', 'dns get')`
- List subnet routes: `cloud_exec('tailscale', 'routes list')`

### KEY CONCEPTS
- **Tailnet**: Your private Tailscale network
- **Device**: Any machine connected to your tailnet
- **Tags**: Labels for devices (must start with 'tag:' prefix)
- **Auth Key**: Token to add devices programmatically
- **ACL**: Access Control List for device communication

### CRITICAL RULES
- Use cloud_exec('tailscale', ...) for device/key/ACL management
- Use tailscale_ssh('hostname', 'command', 'user') to run commands on devices
- Tags must start with 'tag:' prefix (e.g., tag:server)
- Auth key values are only shown once at creation
- Tailscale does NOT provision infrastructure