Connect and authenticate a new device to your Tailscale network (tailnet) with tailscale up

Documented steps

1. Install the Tailscale client for your OS from tailscale.com/download, then run the CLI in a terminal (on Linux this is the tailscale binary backed by the tailscaled daemon; on macOS you can use the menu-bar app or the open-source CLI variant).
2. Bring the node up and authenticate: `tailscale up` (or `sudo tailscale up` on Linux). It prints a login URL; open it in a browser and sign in with your identity provider, or authenticate non-interactively with a pre-created auth key.
3. For unattended/CI registration, pass an auth key: `tailscale up --authkey=$TS_AUTHKEY` (create the key under the admin console Settings > Keys; it can be reusable, ephemeral, and/or preauthorized).
4. Useful connect-time flags: --hostname=<name> to override the OS hostname; --ssh to enable the Tailscale SSH server on this node; --advertise-routes=/--accept-routes=/--exit-node= for subnet routing or exit nodes (handled by dedicated routes).
5. When already up and connected, running `tailscale up` re-applies the full set of flags you pass; any preference you do not specify is reset to its default. To change just one setting without resetting others, use `tailscale set` (see that route).
6. Verify with `tailscale status` (your node shows as `self`) and `tailscale ip -4` for your 100.x.y.z address; or `tailscale ip -6` for the IPv6 form.