Tailscale

Agentic and local-AI installs need private paths to always-on hosts (Studio Ollama, remote Claude Code, IMAP boxes, research DBs) without publishing ports. Tailscale is the network access layer on the observe/admin path: mesh + ACL/grants + optional Tailscale SSH / Serve. Product authority (who may approve, spend, or mutate the ledger) stays in Keycloak / Open Policy Agent / Cedar — Tailscale only decides reachability.

A node authenticates to the control plane, downloads peer keys and the tailnet policy, then builds WireGuard sessions to peers (direct first, DERP fallback). Operators extend the mesh with subnet routers (advertise a CIDR for devices that cannot run Tailscale), exit nodes (default-route internet via a chosen node), Serve (HTTPS reverse-proxy to localhost for the tailnet, with identity headers), Funnel (same idea for the public internet — rarely correct for model/admin APIs), Tailscale SSH (identity-auth SSH on the Tailscale IP), and K8s sidecars/operator for cluster services.

1. Install client / tailscaled; tailscale up with SSO or auth key.
2. Tag servers; write ACL/grants (who → which ports).
3. For localhost UIs/APIs: tailscale serve (private) — avoid Funnel for secrets.
4. Lock host firewalls so public inbound is empty; prove MagicDNS / Tailscale SSH before closing bastion ports.

Related: keycloak · open-policy-agent · cedar · kubernetes · ollama · usages _source/tailscale-usages.md

• Use when: you need private, identity-gated reachability across NATs (home Studio ↔ VPS ↔ laptop/phone) without a classic VPN concentrator — especially for local LLM admin, remote agent hosts, and closing public SSH.
• Skip when: you must expose a service to anonymous internet users (real CDN/LB, or Funnel knowingly), or you require a fully self-hosted control plane with no Tailscale Inc. dependency (Headscale / plain WireGuard).
• Prefer instead: Headscale or self-managed WireGuard for control-plane sovereignty; OPA/Cedar/Keycloak for application authorization; Funnel only for demos/webhooks.

Named limits without a resolution are incomplete — full table: ../_source/tailscale-usages.md § Limits → resolutions.

Limit	Resolution (this stack)
Coordination / join depends on control plane	Hosted Tailscale now; outage = no new nodes/ACL, peers keep working; Tailnet Lock when mesh stabilizes; Headscale only when control plane must be local
DERP relay latency	Design for direct Studio↔server; measure with tailscale ping; fix NAT before blaming the app
Funnel exposes localhost	Funnel denied on tag:studio / tag:server / tag:agent; Serve only; optional tag:demo
Default allow-all ACL	Day-one deny-by-default grants + tags; GitOps policy.hujson
Mesh ≠ authority	Tailscale = ports; Open Policy Agent / Cedar / Keycloak = actions
Linux --accept-routes off	Enable on nodes that use subnet routers / app connectors
macOS App Store limits	Studio/Mac needing Serve or Tailscale SSH → OSS/CLI tailscaled

Operator checklist (live proofs still open): CHECKLIST.md.

Cite: How Tailscale works · Tailnet Lock · policy file syntax · macOS variants · Serve/Funnel docs · science/sources/.