{"slug":"tailscale-daemon-configuration-file","title":"Tailscale daemon configuration file","tags":["tailscale","file-sharing"],"agent_summary":"Last validated: Jan 8, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Tailscale daemon configuration file\r\n\r\nLast validated: Jan 8, 2026\r\n\r\nThe `tailscaled` configuration file support is in alpha and the schema might change in future releases. Tailscale intends to preserve compatibility with earlier versions when possible. If breaking changes occur, a new version designation will be used.\r\n\r\nYou can configure the [Tailscale daemon](https://tailscale.com/docs/reference/tailscaled) (`tailscaled`) using a JSON configuration file instead of command-line flags passed to the [Tailscale CLI](https://tailscale.com/docs/reference/tailscale-cli). This approach is useful for headless deployments, containers, Kubernetes, and [infrastructure-as-code workflows](https://tailscale.com/docs/integration-infrastructure-as-code).\r\n\r\n## [Basic usage](https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file\\#basic-usage)\r\n\r\nThe `tailscaled` configuration file only requires you to set the `version` field manually. The following example shows a minimal configuration example:\r\n\r\n```json\r\n{\r\n \"version\": \"alpha0\",\r\n \"authKey\": \"tskey-auth-example-XXXXX\",\r\n \"hostname\": \"my-server\",\r\n \"acceptRoutes\": true\r\n}\r\n```\r\n\r\nTo start `tailscaled` with a configuration file, use the `--config` flag:\r\n\r\n```shell\r\ntailscaled --config=/etc/tailscale/config.json\r\n```\r\n\r\nThe Tailscale daemon does not automatically discover configuration files. You must specify the path explicitly using the `--config` flag.\r\n\r\n## [Configuration options](https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file\\#configuration-options)\r\n\r\nThe configuration file uses JSON or [HuJSON](https://github.com/tailscale/hujson) format. The following tables describe all available options. This section organizes all configuration options by category.\r\n\r\n### [Required options](https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file\\#required-options)\r\n\r\nThe `version` field is the only required option because all other necessary options have default values. If you omit optional fields, the Tailscale daemon uses the default values.\r\n\r\n| Option | Type | Description |\r\n| --- | --- | --- |\r\n| `version` | String | Required. The version of the configuration file schema. The only supported value is `\"alpha0\"`. |\r\n\r\n### [Authentication](https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file\\#authentication)\r\n\r\nThe following configuration options are for authenticating with the Tailscale [control plane](https://tailscale.com/docs/concepts/control-data-planes).\r\n\r\n| Option | Type | Default | Description |\r\n| --- | --- | --- | --- |\r\n| `serverURL` | String | `https://controlplane.tailscale.com` | Specify the URL of a [custom control server](https://tailscale.com/docs/how-to/set-up-custom-control-server). |\r\n| `authKey` | String | None | Specify an [Auth key](https://tailscale.com/docs/features/access-control/auth-keys) or [OAuth client secret](https://tailscale.com/docs/features/oauth-clients) for authentication. Prefix with `file:` to read from a file path (for example, `file:/etc/tailscale/authkey`). The daemon re-reads the file each time it authenticates with the [control plane](https://tailscale.com/docs/concepts/control-data-planes). |\r\n\r\n### [General settings](https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file\\#general-settings)\r\n\r\nThe following configuration options are options for general Tailscale behavior.\r\n\r\n| Option | Type | Default | Description |\r\n| --- | --- | --- | --- |\r\n| `locked` | Boolean | `true` | Set to `true` to prevent configuration changes by using the [`tailscale set`](https://tailscale.com/docs/reference/tailscale-cli#set) command, ensuring the configuration stays consistent with the file. Set to `false` to allow runtime modifications. |\r\n| `enabled` | Boolean | `true` | Specify whether Tailscale should be running. Setting this to `false` has the same effect as running `tailscale down`. |\r\n| `hostname` | String | OS hostname | Specify the hostname for the device as displayed in the admin console and used for [MagicDNS](https://tailscale.com/docs/features/magicdns). |\r\n| `operatorUser` | String | None | Specify a local Unix username allowed to operate `tailscaled` without root privileges. |\r\n\r\n### [DNS and routing](https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file\\#dns-and-routing)\r\n\r\nThe following configuration options are options for DNS and subnet routing.\r\n\r\n| Option | Type | Default | Description |\r\n| --- | --- | --- | --- |\r\n| `acceptDNS` | Boolean | `true` | Set to `false` to disable using the [DNS configuration](https://tailscale.com/docs/reference/dns-in-tailscale) from the tailnet. |\r\n| `acceptRoutes` | Boolean | [Platform-dependent](https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file#acceptroutes-defaults) | Set to `true` to accept [subnet routes](https://tailscale.com/docs/features/subnet-routers) advertised by other devices. |\r\n| `advertiseRoutes` | Array of Strings | None | An array of [subnet routes](https://tailscale.com/docs/features/subnet-routers) to advertise to the tailnet. Use the format `[\"\"]`. |\r\n| `disableSNAT` | Boolean | `false` | Set to `true` to disable source NAT for traffic to advertised subnet routes. |\r\n\r\nPlatform-dependent default values for `acceptRoutes`:\r\n\r\n- Defaults to `true` for Windows, iOS, Android, the macOS App Store variant, and the macOS Standalone variant.\r\n- Defaults to `false` Unix platforms (Linux, BSD, and the macOS open source variant).\r\n\r\n### [Exit nodes](https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file\\#exit-nodes)\r\n\r\nThe following configuration options are options for [exit nodes](https://tailscale.com/docs/features/exit-nodes).\r\n\r\n| Option | Type | Default | Description |\r\n| --- | --- | --- | --- |\r\n| `exitNode` | String | None | [Exit node](https://tailscale.com/docs/features/exit-nodes) to use. You can use an IP address, stable node ID, or MagicDNS base name. It accepts any value supported by the [`tailscale set --exit-node=`](https://tailscale.com/docs/reference/tailscale-cli#set) command. |\r\n| `allowLANWhileUsingExitNode` | Boolean | `false` | Set to `true` to permit access to the local network (LAN) while routing traffic through an exit node. |\r\n\r\nYou can find the stable node ID of a device in the [Machines](https://login.tailscale.com/admin/machines) of the admin console.\r\n\r\n### [Features](https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file\\#features)\r\n\r\nThe following configuration options are for enabling or disabling specific Tailscale features.\r\n\r\n| Option | Type | Default | Description |\r\n| --- | --- | --- | --- |\r\n| `runSSHServer` | Boolean | `false` | Set to `true` to enable [Tailscale SSH](https://tailscale.com/docs/features/tailscale-ssh) server. |\r\n| `runWebClient` | Boolean | `false` | Set to `true` to enable the Tailscale [web client interface](https://tailscale.com/docs/features/client/device-web-interface). |\r\n| `shieldsUp` | Boolean | `false` | Set to `true` to block all incoming connections from other tailnet regardless of access control policies. You might consider this if you only want to permit outbound connections. This is similar to how you can configure [incoming connections in the Tailscale client](https://tailscale.com/docs/features/client/manage-preferences#allow-incoming-connections). |\r\n| `postureChecking` | Boolean | `false` | Set to `true` to enable [device posture](https://tailscale.com/docs/features/device-posture) data collection. |\r\n| `advertiseServices` | Array of Strings | None | Specify [services](https://tailscale.com/docs/features/services) to advertise (for example, `[\"svc:my-api\"]`). Used with Tailscale Service virtual IP addresses for high availability. |\r\n| `appConnector` | Object | None | [App connector](https://tailscale.com/docs/features/app-connectors) configuration. Set `{\"advertise\": true}` to run as an [app connector](https://tailscale.com/docs/features/app-connectors/how-to/setup). |\r\n\r\n### [Auto-update](https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file\\#auto-update)\r\n\r\nThe following configuration options are options for automatic updates.\r\n\r\n| Option | Type | Default | Description |\r\n| --- | --- | --- | --- |\r\n| `autoUpdate` | Object | None | Auto-update preferences. Set to `check` to enable checking for updates. Set to `apply` to automatically apply updates. For example: `{\"check\": true, \"apply\": false}`. |\r\n\r\n### [Linux-specific options](https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file\\#linux-specific-options)\r\n\r\nLinux-specific configuration options.\r\n\r\n| Option | Type | Default | Description |\r\n| --- | --- | --- | --- |\r\n| `netfilterMode` | String | `\"on\"` | Set the firewall management mode: `\"on\"`, `\"nodivert\"`, or `\"off\"`. This specifies how `tailscaled` manages `iptables`/`nftables` rules on Linux. |\r\n| `noStatefulFiltering` | Boolean | `false` | Set to `true` to disable stateful packet filtering for subnet routers and exit nodes. |\r\n\r\n#### [`netfilterMode` values](https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file\\#netfiltermode-values)\r\n\r\n- `on`: Normal operation. In this mode, `tailscaled` creates `iptables`/`nftables` chains and adds a rule to start of the relevant standard chains that jumps into them. For example, it inserts a jump to `ts-input` at the start of the `filter` table `INPUT` chain, to `ts-forward` from `FORWARD`, to `ts-output` from `OUTPUT`, and so on. It also adds a `ts-postrouting` in the `nat` table.\r\n- `nodivert`: No divert mode. In this mode, `tailscaled` creates `iptables`/`nftables` chains as usual, but does not send traffic to them. For the system to work correctly, you must configure those rules manually (for example, add a jump from `INPUT` to `ts-input`). This makes it possible to have other rules take effect before the Tailscale rules. Using `nodivert` also means that `tailscaled` won't rewrite the jumps occasionally because this would move the Tailscale rules back to the start.\r\n- `off`: In this mode, `tailscaled` does not make any changes to `iptables`/`nftables`. There usually isn't a good reason to use this mode.\r\n\r\n### [Advanced options](https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file\\#advanced-options)\r\n\r\nThe following configuration options are options for advanced use cases, such as customizing the Kubernetes Operators.\r\n\r\n| Option | Type | Default | Description |\r\n| --- | --- | --- | --- |\r\n| `staticEndpoints` | Array of Strings | None | Specify an array of additional [WireGuard](https://tailscale.com/docs/concepts/wireguard) endpoints to advertise alongside discovered endpoints. Use the format `[\"
:\"]`. Refer to [Kubernetes Operator customization](https://tailscale.com/docs/features/kubernetes-operator/how-to/customize#static-endpoints) for more information. |\r\n\r\n## [Schema reference](https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file\\#schema-reference)\r\n\r\nThe following schema shows all available options in a single block. Remove all comments before using this in a JSON file, or use [HuJSON](https://github.com/tailscale/hujson) format to keep them.\r\n\r\n```json\r\n{\r\n \"version\": \"alpha0\", // Required.\r\n \"serverURL\": \"https://controlplane.tailscale.com\", // Optional.\r\n \"authKey\": \"\", // Optional.\r\n \"locked\": true, // Optional.\r\n \"enabled\": true, // Optional.\r\n \"hostname\": \"\", // Optional. Default: OS hostname.\r\n \"operatorUser\": \"\", // Optional.\r\n \"acceptDNS\": , // Optional. Default: platform-dependent.\r\n \"acceptRoutes\": , // Optional. Default: platform-dependent.\r\n \"advertiseRoutes\": [\"\"], // Optional.\r\n \"disableSNAT\": false, // Optional.\r\n \"exitNode\": \"\", // Optional.\r\n \"allowLANWhileUsingExitNode\": false, // Optional.\r\n \"runSSHServer\": false, // Optional.\r\n \"runWebClient\": false, // Optional.\r\n \"shieldsUp\": false, // Optional.\r\n \"postureChecking\": false, // Optional.\r\n \"advertiseServices\": [\"svc:\"], // Optional.\r\n \"appConnector\": {\"advertise\": }, // Optional.\r\n \"autoUpdate\": {\"check\": , \"apply\": }, // Optional.\r\n \"netfilterMode\": \"on\", // Optional (Linux-specific). Values: \"on\", \"nodivert\", \"off\".\r\n \"noStatefulFiltering\": false, // Optional.\r\n \"staticEndpoints\": [\"
:\"], // Optional.\r\n}\r\n```\r\n\r\n## [Read configuration from cloud metadata](https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file\\#read-configuration-from-cloud-metadata)\r\n\r\nInstead of using a configuration file, you can read configuration options directly from cloud instance metadata.\r\n\r\nCloud metadata support is limited to Amazon EC2. Support for Google Cloud Platform (GCP), Azure, and [cloud-init](https://tailscale.com/docs/install/with-cloud-init) is planned for future releases.\r\n\r\nTo read configuration from an [Amazon EC2](https://docs.aws.amazon.com/ec2/) instance, store the configuration in the instance's user data and use the special path `vm:user-data`:\r\n\r\n```shell\r\ntailscaled --config=vm:user-data\r\n```\r\n\r\nThis tells the `tailscaled` daemon to read the configuration from the EC2 instance metadata service at `http:///latest/user-data`.\r\n\r\n## [Reload configuration changes](https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file\\#reload-configuration-changes)\r\n\r\nThe Tailscale daemon reads the configuration file one time at startup and does not automatically monitor it for changes. To apply configuration changes, you have the following options:\r\n\r\n### [Manually reload the configuration](https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file\\#manually-reload-the-configuration)\r\n\r\nUse the `tailscale debug reload-config` command to reload the configuration file without restarting the daemon:\r\n\r\n```shell\r\ntailscale debug reload-config\r\n```\r\n\r\nThis command calls the LocalAPI endpoint `/localapi/v0/reload-config` and applies any changes from the configuration file.\r\n\r\n### [Restart the daemon](https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file\\#restart-the-daemon)\r\n\r\nRestart `tailscaled` to reload the configuration:\r\n\r\n```shell\r\nsudo systemctl restart tailscaled\r\n```\r\n\r\nAutomatic configuration file watching for standalone `tailscaled` deployments is not currently supported. If you need this functionality outside of Kubernetes, consider using a file watcher that calls `tailscale debug reload-config` when it detects changes.\r\n\r\n## [Limitations](https://tailscale.com/docs/reference/tailscaled/tailescaled-config-file\\#limitations)\r\n\r\nYou can use configuration files on Linux and other Unix-like systems where you run `tailscaled` directly. For macOS, refer to [tailscaled on macOS](https://github.com/tailscale/tailscale/wiki/Tailscaled-on-macOS). iOS and Android do not support configuration files.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Tailscale daemon configuration file

\n

Last validated: Jan 8, 2026

\n

The tailscaled configuration file support is in alpha and the schema might change in future releases. Tailscale intends to preserve compatibility with earlier versions when possible. If breaking changes occur, a new version designation will be used.

\n

You can configure the Tailscale daemon (tailscaled) using a JSON configuration file instead of command-line flags passed to the Tailscale CLI. This approach is useful for headless deployments, containers, Kubernetes, and infrastructure-as-code workflows.

\n

Basic usage

\n

The tailscaled configuration file only requires you to set the version field manually. The following example shows a minimal configuration example:

\n
{\r\n  \"version\": \"alpha0\",\r\n  \"authKey\": \"tskey-auth-example-XXXXX\",\r\n  \"hostname\": \"my-server\",\r\n  \"acceptRoutes\": true\r\n}\n
\n

To start tailscaled with a configuration file, use the --config flag:

\n
tailscaled --config=/etc/tailscale/config.json\n
\n

The Tailscale daemon does not automatically discover configuration files. You must specify the path explicitly using the --config flag.

\n

Configuration options

\n

The configuration file uses JSON or HuJSON format. The following tables describe all available options. This section organizes all configuration options by category.

\n

Required options

\n

The version field is the only required option because all other necessary options have default values. If you omit optional fields, the Tailscale daemon uses the default values.

\n

| Option | Type | Description |\r\n| --- | --- | --- |\r\n| version | String | Required. The version of the configuration file schema. The only supported value is \"alpha0\". |

\n

Authentication

\n

The following configuration options are for authenticating with the Tailscale control plane.

\n

| Option | Type | Default | Description |\r\n| --- | --- | --- | --- |\r\n| serverURL | String | https://controlplane.tailscale.com | Specify the URL of a custom control server. |\r\n| authKey | String | None | Specify an Auth key or OAuth client secret for authentication. Prefix with file: to read from a file path (for example, file:/etc/tailscale/authkey). The daemon re-reads the file each time it authenticates with the control plane. |

\n

General settings

\n

The following configuration options are options for general Tailscale behavior.

\n

| Option | Type | Default | Description |\r\n| --- | --- | --- | --- |\r\n| locked | Boolean | true | Set to true to prevent configuration changes by using the tailscale set command, ensuring the configuration stays consistent with the file. Set to false to allow runtime modifications. |\r\n| enabled | Boolean | true | Specify whether Tailscale should be running. Setting this to false has the same effect as running tailscale down. |\r\n| hostname | String | OS hostname | Specify the hostname for the device as displayed in the admin console and used for MagicDNS. |\r\n| operatorUser | String | None | Specify a local Unix username allowed to operate tailscaled without root privileges. |

\n

DNS and routing

\n

The following configuration options are options for DNS and subnet routing.

\n

| Option | Type | Default | Description |\r\n| --- | --- | --- | --- |\r\n| acceptDNS | Boolean | true | Set to false to disable using the DNS configuration from the tailnet. |\r\n| acceptRoutes | Boolean | Platform-dependent | Set to true to accept subnet routes advertised by other devices. |\r\n| advertiseRoutes | Array of Strings | None | An array of subnet routes to advertise to the tailnet. Use the format [\"<CIDR>\"]. |\r\n| disableSNAT | Boolean | false | Set to true to disable source NAT for traffic to advertised subnet routes. |

\n

Platform-dependent default values for acceptRoutes:

\n
    \n
  • Defaults to true for Windows, iOS, Android, the macOS App Store variant, and the macOS Standalone variant.
    • \n
  • Defaults to false Unix platforms (Linux, BSD, and the macOS open source variant).
    • \n
\n

Exit nodes

\n

The following configuration options are options for exit nodes.

\n

| Option | Type | Default | Description |\r\n| --- | --- | --- | --- |\r\n| exitNode | String | None | Exit node to use. You can use an IP address, stable node ID, or MagicDNS base name. It accepts any value supported by the tailscale set --exit-node=<identifier> command. |\r\n| allowLANWhileUsingExitNode | Boolean | false | Set to true to permit access to the local network (LAN) while routing traffic through an exit node. |

\n

You can find the stable node ID of a device in the Machines of the admin console.

\n

Features

\n

The following configuration options are for enabling or disabling specific Tailscale features.

\n

| Option | Type | Default | Description |\r\n| --- | --- | --- | --- |\r\n| runSSHServer | Boolean | false | Set to true to enable Tailscale SSH server. |\r\n| runWebClient | Boolean | false | Set to true to enable the Tailscale web client interface. |\r\n| shieldsUp | Boolean | false | Set to true to block all incoming connections from other tailnet regardless of access control policies. You might consider this if you only want to permit outbound connections. This is similar to how you can configure incoming connections in the Tailscale client. |\r\n| postureChecking | Boolean | false | Set to true to enable device posture data collection. |\r\n| advertiseServices | Array of Strings | None | Specify services to advertise (for example, [\"svc:my-api\"]). Used with Tailscale Service virtual IP addresses for high availability. |\r\n| appConnector | Object | None | App connector configuration. Set {\"advertise\": true} to run as an app connector. |

\n

Auto-update

\n

The following configuration options are options for automatic updates.

\n

| Option | Type | Default | Description |\r\n| --- | --- | --- | --- |\r\n| autoUpdate | Object | None | Auto-update preferences. Set to check to enable checking for updates. Set to apply to automatically apply updates. For example: {\"check\": true, \"apply\": false}. |

\n

Linux-specific options

\n

Linux-specific configuration options.

\n

| Option | Type | Default | Description |\r\n| --- | --- | --- | --- |\r\n| netfilterMode | String | \"on\" | Set the firewall management mode: \"on\", \"nodivert\", or \"off\". This specifies how tailscaled manages iptables/nftables rules on Linux. |\r\n| noStatefulFiltering | Boolean | false | Set to true to disable stateful packet filtering for subnet routers and exit nodes. |

\n

netfilterMode values

\n
    \n
  • on: Normal operation. In this mode, tailscaled creates iptables/nftables chains and adds a rule to start of the relevant standard chains that jumps into them. For example, it inserts a jump to ts-input at the start of the filter table INPUT chain, to ts-forward from FORWARD, to ts-output from OUTPUT, and so on. It also adds a ts-postrouting in the nat table.
    • \n
  • nodivert: No divert mode. In this mode, tailscaled creates iptables/nftables chains as usual, but does not send traffic to them. For the system to work correctly, you must configure those rules manually (for example, add a jump from INPUT to ts-input). This makes it possible to have other rules take effect before the Tailscale rules. Using nodivert also means that tailscaled won't rewrite the jumps occasionally because this would move the Tailscale rules back to the start.
    • \n
  • off: In this mode, tailscaled does not make any changes to iptables/nftables. There usually isn't a good reason to use this mode.
    • \n
\n

Advanced options

\n

The following configuration options are options for advanced use cases, such as customizing the Kubernetes Operators.

\n

| Option | Type | Default | Description |\r\n| --- | --- | --- | --- |\r\n| staticEndpoints | Array of Strings | None | Specify an array of additional WireGuard endpoints to advertise alongside discovered endpoints. Use the format [\"<address>:<port>\"]. Refer to Kubernetes Operator customization for more information. |

\n

Schema reference

\n

The following schema shows all available options in a single block. Remove all comments before using this in a JSON file, or use HuJSON format to keep them.

\n
{\r\n  \"version\": \"alpha0\", // Required.\r\n  \"serverURL\": \"https://controlplane.tailscale.com\", // Optional.\r\n  \"authKey\": \"<auth-key>\", // Optional.\r\n  \"locked\": true, // Optional.\r\n  \"enabled\": true, // Optional.\r\n  \"hostname\": \"<hostname>\", // Optional. Default: OS hostname.\r\n  \"operatorUser\": \"<username>\", // Optional.\r\n  \"acceptDNS\": <true|false>, // Optional. Default: platform-dependent.\r\n  \"acceptRoutes\": <true|false>, // Optional. Default: platform-dependent.\r\n  \"advertiseRoutes\": [\"<CIDR>\"], // Optional.\r\n  \"disableSNAT\": false, // Optional.\r\n  \"exitNode\": \"<IP-address|stable-node-ID|MagicDNS-name>\", // Optional.\r\n  \"allowLANWhileUsingExitNode\": false, // Optional.\r\n  \"runSSHServer\": false, // Optional.\r\n  \"runWebClient\": false, // Optional.\r\n  \"shieldsUp\": false, // Optional.\r\n  \"postureChecking\": false, // Optional.\r\n  \"advertiseServices\": [\"svc:<service-name>\"], // Optional.\r\n  \"appConnector\": {\"advertise\": <true|false>}, // Optional.\r\n  \"autoUpdate\": {\"check\": <true|false>, \"apply\": <true|false>}, // Optional.\r\n  \"netfilterMode\": \"on\", // Optional (Linux-specific). Values: \"on\", \"nodivert\", \"off\".\r\n  \"noStatefulFiltering\": false, // Optional.\r\n  \"staticEndpoints\": [\"<address>:<port>\"], // Optional.\r\n}\n
\n

Read configuration from cloud metadata

\n

Instead of using a configuration file, you can read configuration options directly from cloud instance metadata.

\n

Cloud metadata support is limited to Amazon EC2. Support for Google Cloud Platform (GCP), Azure, and cloud-init is planned for future releases.

\n

To read configuration from an Amazon EC2 instance, store the configuration in the instance's user data and use the special path vm:user-data:

\n
tailscaled --config=vm:user-data\n
\n

This tells the tailscaled daemon to read the configuration from the EC2 instance metadata service at http://<ip-address>/latest/user-data.

\n

Reload configuration changes

\n

The Tailscale daemon reads the configuration file one time at startup and does not automatically monitor it for changes. To apply configuration changes, you have the following options:

\n

Manually reload the configuration

\n

Use the tailscale debug reload-config command to reload the configuration file without restarting the daemon:

\n
tailscale debug reload-config\n
\n

This command calls the LocalAPI endpoint /localapi/v0/reload-config and applies any changes from the configuration file.

\n

Restart the daemon

\n

Restart tailscaled to reload the configuration:

\n
sudo systemctl restart tailscaled\n
\n

Automatic configuration file watching for standalone tailscaled deployments is not currently supported. If you need this functionality outside of Kubernetes, consider using a file watcher that calls tailscale debug reload-config when it detects changes.

\n

Limitations

\n

You can use configuration files on Linux and other Unix-like systems where you run tailscaled directly. For macOS, refer to tailscaled on macOS. iOS and Android do not support configuration files.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}