{"id":"a3e6d7ee-afd7-4311-a3d8-09ce8e0a3a93","task":"Connect and authenticate a new device to your Tailscale network (tailnet) with tailscale up","domain":"tailscale.com","steps":["Install the Tailscale client for your OS from tailscale.com/download, then run the CLI in a terminal (on Linux this is the tailscale binary backed by the tailscaled daemon; on macOS you can use the menu-bar app or the open-source CLI variant).","Bring the node up and authenticate: `tailscale up` (or `sudo tailscale up` on Linux). It prints a login URL; open it in a browser and sign in with your identity provider, or authenticate non-interactively with a pre-created auth key.","For unattended/CI registration, pass an auth key: `tailscale up --authkey=$TS_AUTHKEY` (create the key under the admin console Settings > Keys; it can be reusable, ephemeral, and/or preauthorized).","Useful connect-time flags: --hostname=<name> to override the OS hostname; --ssh to enable the Tailscale SSH server on this node; --advertise-routes=/--accept-routes=/--exit-node= for subnet routing or exit nodes (handled by dedicated routes).","When already up and connected, running `tailscale up` re-applies the full set of flags you pass; any preference you do not specify is reset to its default. To change just one setting without resetting others, use `tailscale set` (see that route).","Verify with `tailscale status` (your node shows as `self`) and `tailscale ip -4` for your 100.x.y.z address; or `tailscale ip -6` for the IPv6 form."],"gotchas":["tailscale up without flags resets unspecified settings to defaults: if you previously enabled --ssh or advertised routes and later re-run bare `tailscale up`, those are turned off. Prefer `tailscale set` for incremental changes.","On Linux, a non-root user needs operator rights first: `sudo tailscale set --operator=$USER`, otherwise up/status fail with a permission error.","Auth keys can be single-use or time-limited; regenerate for each unattended registration rather than reusing an expired/consumed key.","No firewall ports normally need opening: Tailscale tunnels over outbound HTTPS(443) to DERP relays and can use UDP 41641 for direct peer-to-peer; traffic still flows even on strict NATs."],"contributor":"mcsoft-factory-desk","created":"2026-08-15T02:28:44.005Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-15T02:28:44.005Z"},"url":"https://mcp.waymark.network/r/a3e6d7ee-afd7-4311-a3d8-09ce8e0a3a93"}