Chapter 2 · Part I — Fleet Setup

Enrolling the Spark Machines

This chapter covers everything that happens on the Spark machines themselves: installing Tailscale, enabling SSH mode, and authenticating each node to the fleet tailnet. You will repeat these steps once per Spark. For a two-node bundle, run them on both machines before moving to Chapter 3.

Prerequisites
  • SSH or physical access to each Spark running Ubuntu (ARM64)
  • A Tailscale account on the fleet tailnet (the admin account, not a personal one)
  • Internet access from the Spark — the install script downloads from tailscale.com

Step 1 — Install Tailscale

Tailscale provides a one-line installer that handles package repository setup, GPG key import, and daemon startup. Run this on each Spark:

curl -fsSL https://tailscale.com/install.sh | sh

The script auto-detects the OS and architecture. On DGX Spark (Ubuntu ARM64) it installs from the official Tailscale apt repository and starts tailscaled as a systemd service.

What the installer does

StepWhat happens
1Adds pkgs.tailscale.com to /etc/apt/sources.list.d/
2Imports the Tailscale GPG signing key
3Runs apt-get install tailscale
4Enables and starts tailscaled.service via systemd

Verify the daemon is running:

sudo systemctl status tailscaled

Expected output includes Active: active (running).

Step 2 — Bring Up Tailscale with SSH Mode and Tag

The tailscale up command connects the daemon to the tailnet. Run it with two flags: --ssh enables Tailscale SSH (replacing key-based auth with tailnet identity), and --advertise-tags=tag:spark self-applies the ACL tag at enrollment time — no manual console step required.

sudo tailscale up --ssh --advertise-tags=tag:spark

The command prints a login URL:

To authenticate, visit:

        https://login.tailscale.com/a/xxxxxxxxxxxxxxxx
Open the URL in the fleet account browser
This URL must be opened in a browser that is already signed into the fleet tailnet account — not a personal Tailscale account. If you sign into the wrong account, the machine joins the wrong tailnet and you will need to reauthenticate.

After you open the URL and approve the device in the browser, the terminal shows:

Success.

The Spark is now on the tailnet with SSH enabled and the tag:spark tag applied. Verify with:

tailscale status

You should see the machine listed with its 100.x.x.x Tailscale IP. In the admin console, the machine row will show tagged-devices (not your personal account) as the owner — confirming the tag took effect.

What each flag does

FlagEffect
--sshTailscale intercepts SSH on the tailnet interface; ACL policy becomes the sole auth check — no authorized_keys needed
--advertise-tags=tag:sparkSelf-applies tag:spark at enrollment; the SSH rule in Chapter 3 targets this tag — no admin console click required
tagOwners must be defined first
The tag:spark tag must be declared in the ACL policy's tagOwners section before --advertise-tags will accept it. If you see an error about an undefined tag, set up the ACL in Chapter 3 first, then re-run this command. Running sudo tailscale up --ssh --advertise-tags=tag:spark on an already-connected machine simply re-applies the flags — you do not need to re-authenticate.

Step 3 — Verify the Tag in the Admin Console

The --advertise-tags flag handles tagging automatically, but it is worth confirming in the admin console — especially if this is your first enrollment.

In the admin console

  1. Go to login.tailscale.com/admin/machines
  2. Find your Spark in the machine list (look for the hostname or Tailscale IP)
  3. The Owner column should show tagged-devices instead of your email — this confirms the tag is active
  4. Click the machine row → Machine details to see the full tag list

If the tag is missing (Owner still shows your email), click ⋯ → Edit ACL tags, type tag:spark and confirm. Then verify tagOwners is defined in the ACL policy (Chapter 3).

What tagging does to node key expiry

An important operational side effect: tagged devices never require re-authentication. Untagged personal devices must re-login every ~180 days (the Tailscale key expiry default). A tagged server-class device — like a DGX Spark — has its node keys refreshed automatically and will never silently drop off the tailnet because someone forgot to re-login.

Device typeKey expiryRe-auth required
Untagged (personal device)~180 daysYes — human login needed
Tagged (server, e.g. tag:spark)NeverNo — automatic refresh

This is why tagging is not just an access-control choice — it is the right operational posture for any machine that must stay on the tailnet permanently.

Checkpoint

At the end of this chapter both Spark machines should:

  • Have tailscaled running as a systemd service
  • Be connected to the fleet tailnet with a 100.x.x.x IP
  • Have Tailscale SSH enabled (--ssh flag)
  • Carry the tag:spark ACL tag (shown as tagged-devices in the admin console)