Erich Blume
7ebac4aef6
## Summary - Create tutorials directory structure with index page - Add 5 main tutorials targeting different audiences: - **what-is-blumeops** (Reader, AI) - High-level orientation - **exploring-the-docs** (All) - Navigation guide - **ai-assistance-guide** (AI, Owner) - Context for AI-assisted operations - **contributing** (Contributor) - First contribution workflow - **replicating-blumeops** (Replicator) - Overview for building similar setup - Add 4 replication sub-tutorials: - tailscale-setup, kubernetes-bootstrap, argocd-config, observability-stack - Update README.md to mark Phase 3 complete - Add changelog fragment Each tutorial explicitly identifies its target audiences and links to reference material rather than re-explaining concepts. ## Deployment and Testing - [x] All pre-commit hooks pass (doc-links validates wiki links) - [ ] Build docs via workflow to verify rendering - [ ] Review content for accuracy 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/94
134 lines
3.2 KiB
Markdown
134 lines
3.2 KiB
Markdown
---
|
|
title: tailscale-setup
|
|
tags:
|
|
- tutorials
|
|
- replication
|
|
- tailscale
|
|
---
|
|
|
|
# Setting Up Tailscale
|
|
|
|
> **Audiences:** Replicator
|
|
|
|
This tutorial walks through establishing a Tailscale mesh network as the foundation for your homelab infrastructure.
|
|
|
|
## Why Tailscale?
|
|
|
|
Tailscale solves several problems at once:
|
|
- **Secure connectivity** - WireGuard-encrypted traffic between all devices
|
|
- **No port forwarding** - Devices connect directly through NATs and firewalls
|
|
- **MagicDNS** - Human-readable names like `server.tailnet.ts.net`
|
|
- **ACLs** - Fine-grained access control between devices
|
|
|
|
For BlumeOps context, see [[tailscale|Tailscale Reference]].
|
|
|
|
## Step 1: Create Your Tailnet
|
|
|
|
1. Sign up at [tailscale.com](https://tailscale.com)
|
|
2. Choose your identity provider (Google, Microsoft, GitHub, etc.)
|
|
3. Note your tailnet name (e.g., `yourname.ts.net`)
|
|
|
|
## Step 2: Install on Your Devices
|
|
|
|
### macOS
|
|
|
|
```bash
|
|
brew install tailscale
|
|
sudo tailscaled &
|
|
tailscale up
|
|
```
|
|
|
|
### Linux
|
|
|
|
```bash
|
|
curl -fsSL https://tailscale.com/install.sh | sh
|
|
sudo tailscale up
|
|
```
|
|
|
|
### Other Platforms
|
|
|
|
See [Tailscale Downloads](https://tailscale.com/download) for iOS, Android, Windows, etc.
|
|
|
|
## Step 3: Verify Connectivity
|
|
|
|
After installing on two devices:
|
|
```bash
|
|
tailscale status
|
|
# Shows all connected devices
|
|
|
|
ping <other-device>.yourname.ts.net
|
|
# Should work immediately
|
|
```
|
|
|
|
## Step 4: Configure ACLs
|
|
|
|
Default Tailscale allows all-to-all connectivity. For a homelab, you'll want restrictions.
|
|
|
|
Create `policy.hujson` (or use the web admin):
|
|
```json
|
|
{
|
|
"groups": {
|
|
"group:admin": ["your-email@example.com"]
|
|
},
|
|
"tagOwners": {
|
|
"tag:homelab": ["group:admin"]
|
|
},
|
|
"acls": [
|
|
// Admins can access everything
|
|
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]},
|
|
// Homelab servers can reach NAS
|
|
{"action": "accept", "src": ["tag:homelab"], "dst": ["tag:nas:*"]}
|
|
]
|
|
}
|
|
```
|
|
|
|
BlumeOps manages ACLs via Pulumi - see [[tailscale|Tailscale Reference]] for the actual configuration.
|
|
|
|
## Step 5: Enable MagicDNS
|
|
|
|
In the Tailscale admin console:
|
|
1. Go to DNS settings
|
|
2. Enable MagicDNS
|
|
3. Optionally add a search domain
|
|
|
|
Now `ssh server` works instead of `ssh 100.x.y.z`.
|
|
|
|
## Step 6: Tag Your Devices
|
|
|
|
Tags enable role-based access control:
|
|
```bash
|
|
# On your server
|
|
sudo tailscale up --advertise-tags=tag:homelab
|
|
```
|
|
|
|
Tags must be defined in ACLs before use.
|
|
|
|
## What You Now Have
|
|
|
|
- Encrypted mesh network between all your devices
|
|
- DNS names for each device
|
|
- Foundation for exposing services securely
|
|
|
|
## Next Steps
|
|
|
|
With networking established:
|
|
- [[tutorials/replication/kubernetes-bootstrap | Bootstrap Kubernetes]] - Your cluster will join the tailnet
|
|
- Set up your server and storage devices
|
|
|
|
## BlumeOps Specifics
|
|
|
|
BluemeOps' Tailscale configuration includes:
|
|
- Multiple device tags (`homelab`, `nas`, `registry`, `k8s-api`)
|
|
- Group-based access for family members
|
|
- SSH access rules with authentication requirements
|
|
|
|
See [[tailscale|Tailscale Reference]] for full details.
|
|
|
|
## Troubleshooting
|
|
|
|
| Problem | Solution |
|
|
|---------|----------|
|
|
| Device won't connect | Check firewall allows UDP 41641 |
|
|
| Can't reach other devices | Verify ACLs don't block traffic |
|
|
| DNS not resolving | Enable MagicDNS in admin console |
|
|
| Tags not applying | Ensure tags defined in ACL policy |
|