Back Matter

Command Cheatsheet

Quick reference for every Tailscale command used in this book, organized by context.

On the Spark Machine (Linux / Ubuntu ARM64)

Install Tailscale

curl -fsSL https://tailscale.com/install.sh | sh

Enable Tailscale with SSH mode and connect

sudo tailscale up --ssh --advertise-tags=tag:spark

Check daemon status

sudo systemctl status tailscaled

Verify this machine is on the tailnet

tailscale status

Check whether SSH mode is enabled

tailscale debug prefs | grep -i runssh

"RunSSH": true means this machine accepts inbound Tailscale SSH. If you see false, run sudo tailscale up --ssh --advertise-tags=tag:spark again.

Enable SSH mode on an already-connected machine

sudo tailscale up --ssh --advertise-tags=tag:spark

On the Operator Laptop (macOS)

Install Tailscale

brew install tailscale

Start the daemon

sudo brew services start tailscale

Restart the daemon (fix version mismatch warnings)

sudo brew services restart tailscale

Authenticate to the fleet tailnet

tailscale login

Connect to the tailnet

tailscale up

Show all tailnet peers

tailscale status

Inspect peer tags (requires jq)

tailscale status --json | jq '.Peer[] | {name: .HostName, tags: .Tags}'

SSH Commands

SSH by Tailscale IP (via tailscale ssh)

tailscale ssh stoke@100.70.xx.xx
tailscale ssh stoke@100.67.xx.xx

SSH by MagicDNS hostname

tailscale ssh stoke@spark-bundle2-2.tail8a84f6.ts.net
tailscale ssh stoke@spark-bundle2-1.tail8a84f6.ts.net

SSH with plain ssh (after tailscale up)

ssh stoke@100.70.xx.xx

Admin Console Quick Reference

TaskAdmin Console Path
Invite a userUsers → Invite users
Remove a userUsers → (user) → Remove
Edit ACL policyAccess controls
Apply tag to a machineMachines → (machine) → ⋯ → Edit ACL tags
View machine Tailscale IPMachines → (machine row)
View MagicDNS hostnameMachines → (machine) → Machine details
Check key expiryMachines → (machine) → Machine details → Key expiry

ACL Policy Snippets

Minimum working policy for this book

{
  "groups": {
    "group:operators": ["alice@gmail.com", "bob@company.com"]
  },
  "tagOwners": {
    "tag:spark": ["autogroup:admin"]
  },
  "ssh": [
    {
      "action": "accept",
      "src":    ["group:operators"],
      "dst":    ["tag:spark"],
      "users":  ["stoke"]
    }
  ]
}

Add a new operator

// In the "groups" section, add their Tailscale login email:
"group:operators": ["alice@gmail.com", "bob@company.com", "carol@company.com"]

Restrict one operator to a single Spark

// Give that Spark a unique tag:
"tagOwners": {
  "tag:spark":     ["autogroup:admin"],
  "tag:spark-dev": ["autogroup:admin"]
},
// Add a scoped SSH rule:
"ssh": [
  { "action": "accept", "src": ["group:operators"], "dst": ["tag:spark"],     "users": ["stoke"] },
  { "action": "accept", "src": ["carol@company.com"], "dst": ["tag:spark-dev"], "users": ["stoke"] }
]