Tailscale

Network reachability is separate from execution permission. Factory workers use their configured network profile; joining a Tailnet does not grant them access to other machines, projects or production services.

Tailscale supplies network connectivity. Forgejo still authenticates browser users, and ordinary OpenSSH authenticates project access. Soda does not replace OpenSSH with Tailscale SSH. Tailnet administrators own device approval, access policy and route approval.

Initial cloud connection

Use the provider/VM console as the native host operator, not public SSH:

tailscale up

Open the authentication URL in your own browser and sign in to the intended Tailnet. Keep that URL out of shared logs/screenshots. Complete device approval in Tailscale administration when required. No developer account or project membership is created by enrollment.

Inspect the native state and private address:

tailscale status
tailscale ip -4

Join the permitted client to the Tailnet, then use the private operator SSH route and Cockpit tunnel. Finish operator setup for browser endpoints. Keep provider public ingress closed and the console available.

Use the native Tailnet page

The Tailnet operator entry lives under Site administration → Soda → Tailnet, not the global top bar. The fixed bookmark /-/soda/settings/tailnet also works without first entering Spaces or logging in to Soda. Native administration visibility does not grant management access: the configured Soda operator remains required. The page renders in Forgejo's native administration layout, so native site-admin eligibility is also required, including for direct bookmarks. Native administration visibility does not replace the configured Soda operator requirement.

For a reachable, paired deployment, open Tailnet → Appliance, select Sign in, follow the explicit authentication link and observe the resulting identity. Saving or acknowledging an action is not proof of connection. Leaving the page does not log the host out; refreshing observes and never reenrolls.

Visible peers and a connected device are not proof that a policy permits a particular service. Use the advertised name when the client's DNS supports it, or the actual Tailnet IP. Project labels are not Tailnet DNS names.

Automatic project access

The operator separately configures Automatic project access with a restricted OAuth credential, exact Tailnet/tags and approval choice. This is not the appliance's node identity. New projects can explicitly select the reviewed managed network; legacy requests and existing projects remain Off. Each started managed project uses its own ephemeral node without asking a developer to perform provider login.

The project Network tab separates saved intent, queued startup, observed connection and uncertainty. Administrators/operators can enable, disable or retry native startup; a read never retries enrollment. Members receive only authorized metadata and their own ordinary SSH account/fingerprint. Missing or uncertain run state does not permit automatically issuing another key. Native DNS, lifecycle and intended-client connectivity must be verified for each deployment.

Route the project subnet

The host's Tailnet IP and the project bridge subnet are separate networks. Host enrollment alone does not make project IPs reachable.

The operator must:

1. Select the actual non-overlapping project subnet configured at installation.
2. Follow Tailscale subnet-router setup for native forwarding and advertisement on the appliance.
3. Obtain the Tailnet administrator's route approval and appropriate access rules.
4. Enable route acceptance on clients where their platform requires it.
5. Check direct SSH to the displayed project IP and intended service ports from an actual developer client.

Preserve existing routing/firewall choices and restrict forwarding to intended private traffic. Do not advertise a guessed example subnet or overwrite other advertised routes. An alternative on a trusted LAN is a router route for the project subnet via the appliance; do not install conflicting routes blindly.

Forgejo address refresh

The dashboard requires an explicit confirmed request for Forgejo Git SSH advertisement refresh after observing a connected host. Reads do not request it. The native Git listener must already accept the selected private address on port 2222. A LAN-only listener is not made Tailnet-accessible by changing its advertised address.

Unchanged advertisement needs no restart. A change can restart Forgejo, so coordinate it with active users. Enrollment success and refresh failure are separate results; fix the listener/configuration problem before using the page's refresh retry. Browser/OAuth origins remain configured separately and are not rewritten from the Tailnet name.

Optional exit nodes

An exit node routes Internet-bound traffic through a device. It is not needed for ordinary Tailnet access and does not replace a project-subnet route. The page supports native exit-node selection, advertisement and the preference for allowing local-network access while using an exit node.

Read Tailscale's exit-node guidance before changing a shared server's routing. Advertisement requires approval; neither advertisement nor approval alone proves routed traffic works.

Diagnose or leave the Tailnet

Read native diagnostics and tailscale status before re-enrolling. Use Tailscale's CLI reference for native actions. Keep console access for logout or route changes that may cut off your session.

A native tailscale logout removes private connectivity until reauthentication; review the device record and policy separately. Cockpit logout does not log out Tailscale. None of these network actions revokes a Forgejo account, Git token or project SSH key by itself.