Fall 2026brianmars.comBuilt at EGBT Technologies
BrianMars
ReferenceNetwork

Tailscale on a server

Tailscale for a stable address on any network, with MagicDNS on, key expiry off, and Tailscale SSH left out on purpose.

By Brian Mars · Verified 17 Oct 2026 · Part 2 of the devbox build

Names and addresses are placeholders. The list says what each one stands for.

What it does here

Tailscale is how every other device finds the box, from home or anywhere else. It handles discovery and the private network. SSH and mosh run over it.

From the manual

Canonical setup

Install with Tailscale's script, bring the node up, and sign in with an identity provider. Sign in with the same identity on every device: that's what puts them in one tailnet.

Install and join
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Follow the printed URL to sign in. Tailscale signs you in through Google, Microsoft, GitHub or Apple; there's no plain email signup.

Upstream: Install Tailscale on Linux, MagicDNS, Key expiry.

Edited for this build

In this build

  1. No --ssh flagPlain tailscale up. The box keeps its own hardened OpenSSH, which mosh needs.
  2. MagicDNS onIn the admin console under DNS. The box then answers as devbox and devbox.example.ts.net.
  3. Key expiry disabled for this machineIn the admin console, on the machine's menu. A server shouldn't drop off the tailnet on a schedule.
  4. Every other device joined with the same identityLaptop, phone, desktop: the same install on Linux, the app elsewhere.

On a personal tailnet, the ts.net suffix is generated by Tailscale, not taken from your domain. Copy the real one from the DNS page; later cards use it.

If your mail domain isn't a Google Workspace or Microsoft 365 login, signing in with Apple (an Apple ID on that address) works. Share your real email when Apple asks rather than a private relay address, which is harder to recover. That gives a personal tailnet, which is right for a single-admin box.

Optional: to reach devices on the home network that can't run Tailscale, advertise the subnet from this box with sudo tailscale up --advertise-routes=192.168.x.0/24 and approve the route in the admin console.

Where it breaks

Seams

Where this meets the rest of the build. Each one leads with what you will actually see.

Tailscale SSH meets mosh

Symptommosh fails during its startup handshake

Tailscale SSH takes over port 22 in a way mosh's startup can't get through. Leave it off and use OpenSSH over the tailnet; key auth there is just as private.

Key expiry meets a server

Symptomthe box drops off the tailnet months after setup

Node keys expire by default, and an unattended server can't sign itself back in. Disable key expiry for this machine in the admin console.

A personal tailnet meets your domain

Symptomthe MagicDNS name isn't under your domain

That's expected. The ts.net name is Tailscale's; your own domain is used separately for service names on the Caddy card.

Verify

Checks
tailscale status          # this box and your other devices
tailscale ip -4           # the box's 100.x.y.z address
ssh youruser@devbox       # from another device on the tailnet
Corrections and updates
  1. 17 Oct 2026First written.