tailnet lock issues

[yanfali]

I'm looking for guidance on what best practices are for tailnets where lock is enabled. I am able to successfully add tsdproxy services to my tailnet, they come up unsigned. I can sign the new nodes and them to the tailnet. Services initially work and I am able to use them successfully.

I have disabled expiry for the keys on the proxied services. However at some point the key expires anyway. This is not what I was expecting. Do you have any advice as how to prevent this from happening? tsdproxy is an awesome project and I'm just looking for advice on how to keep these running operationally.

Thanks

[yanfali]

I am not updating these expirations. Is this a feature of tsdproxy?

[yanfali]

It seems just restarting the proxied container causes the key to expire. For my tsdproxy I am using a non-expiring auth key. I had hoped this would be enough.

[yanfali]

Yep that's it. When I restart the jellyfin container it expires the key automatically. I even did this with a tagged auth key. Is there a way to prevent this behavior? Thanks

[freezurbern]

I suggest trying a tailscale key with "Pre-approved" checked during creation.

[DarrenYOW]

Device approval can't be used while tailnet lock is enabled. Device approval must be enabled in order for the "Pre-Approved" option to be available during key creation. In my case, it was NOT enabled prior to turning on the tailnet lock. As a result, I have to manually re-approve each container if they are recreated. Not the end of the world, but it is inconvenient.

[yanfali]

Device approval can't be used while tailnet lock is enabled. Device approval must be enabled in order for the "Pre-Approved" option to be available during key creation. In my case, it was NOT enabled prior to turning on the tailnet lock. As a result, I have to manually re-approve each container if they are recreated. Not the end of the world, but it is inconvenient.

Thanks. Ya, it's pretty painful to use it with lock. So if I disable lock then add the machine and then do pre-approval and then turn lock back on it would work?

[DarrenYOW]

Device approval can't be used while tailnet lock is enabled. Device approval must be enabled in order for the "Pre-Approved" option to be available during key creation. In my case, it was NOT enabled prior to turning on the tailnet lock. As a result, I have to manually re-approve each container if they are recreated. Not the end of the world, but it is inconvenient.

Thanks. Ya, it's pretty painful to use it with lock. So if I disable lock then add the machine and then do pre-approval and then turn lock back on it would work?

Sorry, I don't know. I am not able to turn off the tailnet lock to test that use case.

[cattaildumpling]

Device approval can't be used while tailnet lock is enabled. Device approval must be enabled in order for the "Pre-Approved" option to be available during key creation. In my case, it was NOT enabled prior to turning on the tailnet lock. As a result, I have to manually re-approve each container if they are recreated. Not the end of the world, but it is inconvenient.

Thanks. Ya, it's pretty painful to use it with lock. So if I disable lock then add the machine and then do pre-approval and then turn lock back on it would work?

Happy to hear if this workflow works or not. Every time I restart a container it seems to be offline in the admin panel. Then I need to delete the machine and tsdproxy creates a new one. After that I need to approve the new machine again.

[yanfali]

Device approval can't be used while tailnet lock is enabled. Device approval must be enabled in order for the "Pre-Approved" option to be available during key creation. In my case, it was NOT enabled prior to turning on the tailnet lock. As a result, I have to manually re-approve each container if they are recreated. Not the end of the world, but it is inconvenient.

Thanks. Ya, it's pretty painful to use it with lock. So if I disable lock then add the machine and then do pre-approval and then turn lock back on it would work?

Happy to hear if this workflow works or not. Every time I restart a container it seems to be offline in the admin panel. Then I need to delete the machine and tsdproxy creates a new one. After that I need to approve the new machine again.

My exact problems. I haven't figured out what to do yet. I may just spin up a traditional reverse proxy and do a sidecar and just point at the apps I want to use