Make Tailscale onramp easier

ublue-os / bluefin

The next generation Linux workstation, designed for reliability, performance, and sustainability.

https://projectbluefin.io

Apache License 2.0

1.27k stars 163 forks source link

Make Tailscale onramp easier #862

Open bronson opened 10 months ago

bronson commented 10 months ago

There are some minor difficulties when using Tailscale on Bluefin.

The user needs to manually run sudo tailscale set --operator=$USER, otherwise the Tailscale QS extension silently fails (when modifying Tailscale, like enabling/disabling, or setting DNS). And, when Tailscale QS fails, it offers no indication that anything is wrong or what to do next.

tailscale set --operator would be run during install so the user doesn't need to remember (or just ship files pre-configured with the user as operator).
- before this can happen, we need to be confident that it doesn't open Bluefin users to obscure security issues.
- and, are there other unforseen downsides to making the user the operator?

Also, ideally, Tailscale QS would provide better feedback

bronson commented 10 months ago

Related, as part of Tailscale QS providing better feedback...

Sometimes the VPN doesn't work and the gui is unresponsive. When you run the cli, it prints a login link. Why doesn't the GUI just open the browser to reauth you?

bsherman commented 10 months ago

Interesting, I didn't realize tailscale set --operator was a thing, but I also don't use "Tailscale QS" since I have enough nodes on my tailnet, it hasn't worked well for me in the past. Instead, I've used "Tailscale Status".

My point, I've never needed tailscale operator with either CLI or the Tailscale Status ... actually, i didn't need it for Tailscale QS either. So I wonder if something else is going on in your configuration.

Side comment: ublue-os/bluefin don't maintain that extension, though it is included in the images. So anything specific problems with how it interacts with ublue/bluefin we definitely want to solve, but other feedback for Tailscale QS would need to go upstream.

bronson commented 10 months ago

More info, researched in this Discord thread:

operator is only needed call the Tailscale API. The Tailscale CLI works fine without it.
Tailscale Status shells out to the command line. That's why this affects Tailscale QS, not Tailscale Status.
Here is the upstream issue for too many nodes: https://github.com/joaophi/tailscale-gnome-qs/issues/11

KyleGospo commented 10 months ago

Can borrow this: https://github.com/ublue-os/bazzite/commit/e6937241f851f93f7c20e98743ee99e1f1803f59