---
title: "Connecting Tailscale"
description: "Put Indent's computers on your tailnet so sessions can reach services that aren't on the public internet."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.indent.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting Tailscale

A session running in an environment with Tailscale reaches the same private services your team
reaches: an internal API, a staging database, anything behind a subnet router.

Each computer joins your tailnet as a tag-owned, ephemeral node. Your access control policy decides
what it reaches. Tailscale removes the node about an hour after it goes offline.

A session suspends when it's been idle, which takes its computer offline. A session suspended for
long enough loses its node and rejoins your tailnet with a new address when it resumes.

> **Note**
>
> A [connected database](/connecting/databases) is ordinarily queried from Indent's own
> infrastructure, not from the computer. A database that only accepts connections from your tailnet
> is reached through the computer instead.

## Requirements

- Owner, Admin, IT admin, or Network admin access to your tailnet.
- An [environment](/getting-started/environments) for the repository your sessions run in.

## Prepare your tailnet

1. **Create a tag**

   Add `tag:indent` to `tagOwners` in your [access control
   policy](https://login.tailscale.com/admin/acls).

```json
"tagOwners": {
  "tag:indent": ["autogroup:admin"],
},
```
2. **Grant the tag access**

   A computer reaches nothing until a grant names its tag.

```json
"grants": [
  {
    "src": ["tag:indent"],
    "dst": ["tag:staging"],
    "ip": ["tcp:443", "tcp:5432"],
  },
],
```
3. **Create an OAuth credential**

   On the [Trust credentials](https://login.tailscale.com/admin/settings/trust-credentials) page,
   generate an OAuth credential with **Keys → Auth Keys → Write** and the tag `tag:indent`.

   Copy the client secret. Tailscale shows it once.

   An OAuth client secret doesn't expire. An auth key expires after at most 90 days.

## Configure the environment

Open the environment from
[**Settings → Environments**](https://app.indent.com/settings/environments) and select the
**Configure** step.

1. **Ask Indent to install Tailscale**

   Indent writes the Dockerfile, so ask it to install Tailscale from `tailscale.com/install.sh`. The
   Dockerfile gains a line like this one:

```dockerfile
RUN curl -fsSL https://tailscale.com/install.sh | sh
```

   The Tailscale daemon starts when the computer boots.
2. **Add the client secret to Runtime variables**

   Select **Add variable**, enter `TS_AUTHKEY` as the key, and paste the client secret as the value.
   Indent sees the key, never the value.

   Use **Runtime variables** rather than **Environment variables**. The latter applies to the build,
   and the secret is needed while the computer is running.
3. **Add a process that joins the tailnet**

   Under **Processes**, select **Add process**, name it `tailscale`, and set its **Command** to:

```bash
while true; do sudo tailscale status >/dev/null 2>&1 || sudo tailscale up --auth-key="${TS_AUTHKEY}?ephemeral=true&preauthorized=true" --advertise-tags=tag:indent --hostname="indent-${COMPUTER_ID}" --accept-routes --shields-up; sleep 30; done
```

`ephemeral=true` registers a node that Tailscale removes on its own. `preauthorized=true` skips
device approval. `--shields-up` blocks inbound connections, so the computer reaches your tailnet and
your tailnet does not reach the computer. `--accept-routes` picks up the routes your subnet routers
advertise. Names resolve through MagicDNS when your tailnet has it enabled.

`COMPUTER_ID` is set on every computer, so each node gets its own name. The loop rejoins the tailnet
after a suspension long enough to have removed the node.

## Confirm it works

Select **Build + Verify**, then **Publish**. Start a session in the environment and ask Indent to
run `tailscale status`, or to reach one of the services you granted. The node appears on your
[Machines](https://login.tailscale.com/admin/machines) page as `indent-<computer id>`.

> **Caution**
>
> Anyone who can start a session in the environment reaches every service the grant allows, and so
> does the code Indent runs there. Grant the narrowest set of destinations and ports the work needs.

## Revoke access

Revoke the credential on the
[Trust credentials](https://login.tailscale.com/admin/settings/trust-credentials) page to stop new
computers from joining. Computers already on your tailnet keep their access. Delete their nodes on
the [Machines](https://login.tailscale.com/admin/machines) page, or ask Indent to run
`tailscale logout`, which removes a node immediately.

## Troubleshooting

Ask Indent to read `~/.indent/background-processes/tailscale.log`.

- `API token invalid` — the secret in `TS_AUTHKEY` is wrong or revoked.
- `requested tags are invalid or not permitted` — the credential doesn't own `tag:indent`.
- The node joins and reaches nothing — no grant names `tag:indent`.
- A tailnet with Tailnet Lock enabled rejects node keys that a signing node hasn't signed. This
  setup doesn't sign them.

## Next steps

- [Setting up environments](/getting-started/environments) — build the environment this
  configuration goes in.

Source: https://docs.indent.com/connecting/tailscale/index.mdx