Tailscale

Tailscale does three things on this box: lets me reach my own machines from anywhere, lets a couple of collaborators reach this box without setting up a VPN, and gives Filedrop a public HTTPS URL via Funnel without involving Cloudflare.

Node identity

• This node: discourse = 100.78.52.16
• MagicDNS suffix: <TAILNET>.ts.net
• Tailscale SSH: off (RunSSH: false) — admin SSH still uses regular sshd with keys
• Subnet routes advertised: none
• Shields up: no

Tailnet membership

The tailnet is shared across three owners — peers move between them without re-auth:

Node	Owner	Notes
discourse	drewgrif@	this server
um890pro	drewgrif@	workstation
zeus	thelinuxcast@	collaborator workstation
nates-macbook-air	natepickstechworld@	collaborator
pop-os	natepickstechworld@	collaborator

Sharing the tailnet (rather than separate tailnets + node-share) means everyone sees the box at the same MagicDNS name and can be granted SSH/HTTP access without per-user wiring.

Tailscale Funnel — Filedrop public URL

Filedrop (:8081) is not in cloudflared/config.yml. Its only public path is Tailscale Funnel:

https://discourse.<TAILNET>.ts.net  →  http://127.0.0.1:8081

Configured with:

sudo tailscale funnel --bg --https=443 http://127.0.0.1:8081

Inspect:

tailscale funnel status
tailscale serve status

Funnel gives a Let's Encrypt cert and a public URL with no DNS to manage — perfect for a single-purpose drop link to share with one person.

Why both Cloudflare Tunnel and Tailscale Funnel?

	Cloudflare Tunnel	Tailscale Funnel
Custom domain	yes	no (always *.ts.net)
Setup cost per service	DNS record + ingress edit	one command
Best for	branded public sites	throwaway/share URLs

Polished domains use Cloudflare; one-off shares use Funnel.

Common ops

tailscale status            # peers, online state
tailscale ip -4             # this node's tailnet IP
tailscale up --ssh          # enable Tailscale SSH (currently off)
tailscale funnel off        # take Filedrop off public funnel
sudo systemctl restart tailscaled