Tailnet

Apps, and the dashboard itself, can be served only on your Tailscale network instead of the internet. Each address is a machine on your tailnet, like grafana.tail8c3e2.ts.net, with its own HTTPS certificate, reachable only from your devices.

Layup connects to Tailscale with an OAuth client: credentials that let it create machines, see which exist, and delete them when their routes go away. It never expires, and no machine is left behind.

Set up Tailscale

It takes three steps in the Tailscale admin console. The Tailnet card under Server > Networking links to the first two.

1. Create a tag

Machines Layup creates carry a tag, which you choose, such as tag:layup. In the admin console, open Access controls, and add the tag to tagOwners in the policy file:

"tagOwners": {
  "tag:layup": ["autogroup:admin"]
}

Copy tag owner on the Tailnet card copies this line with your tag. Save the policy file.

2. Create an OAuth client

Open Settings > OAuth clients (or Trust credentials) and generate a client with:

Scope	Access	Tags
Devices > Core	Write	tag:layup
Keys > Auth Keys	Write	tag:layup

The tag field only offers tags already in the policy file, which is why the tag comes first. Copy the client secret, which starts with tskey-client-. It's shown once.

3. Turn on MagicDNS and HTTPS

Under DNS, make sure MagicDNS and HTTPS Certificates are on. New tailnets have them on.

Connect

On the Tailnet card, enter the tag and the client secret, then Connect. Layup checks everything in order: the secret, both permissions, the tag, MagicDNS and HTTPS. Whatever is missing is named under the field it belongs to.

Then:

• Serve this dashboard on the tailnet adds a layup machine for the dashboard.
• On an app's Networking tab, Add route > Tailnet gives it a machine. Names already taken on your tailnet are refused.

Each machine shows Joining tailnet for its first few seconds, and Offline if it loses its connection.

The first visit to a new machine's address takes up to half a minute while Tailscale issues its certificate.

Disconnect

Disconnect removes every tailnet route and deletes their machines from your tailnet.

Headscale

Running your own Headscale server instead? Choose Headscale on the Tailnet card and enter its address and a reusable pre-auth key.