My weekend Ansible update run flagged three machines as unreachable, and the culprit turned out to be expired Tailscale keys, which expire by default every 180 days. Re-authenticating remote machines is awkward because force-reauth drops any SSH session running over Tailscale, while reauthorization from the admin page only grants temporary access. Ways around the problem include disabling key expiry per machine in the admin console, and I also note that expiry dates aren’t easily visible in the CLI or admin page...
When I ran Tailscale inside an unprivileged LXC container on Proxmox, it failed at tailscale up with a “no backend” error, because the container lacked access to the TUN/TAP device Tailscale needs. My fix was to stop the container, add a device allow rule and a bind mount entry for /dev/net/tun to its LXC config file, then start it and run tailscale up again...
While setting up an Ubuntu 20.04 LXC on Proxmox to run a TP-Link Omada controller, I found DNS resolution failing because Proxmox copies the host’s Tailscale-based resolv.conf into containers, and the container has no route to the Tailscale DNS address. In this post, I cover the diagnosis of why Debian templates behaved differently, plus two fixes: specifying DNS explicitly in the Proxmox GUI, or creating a .pve-ignore.resolv.conf file so Proxmox stops overwriting the container’s settings...
Ahead of upgrading my Proxmox homelab node from 7.4 to 8.0, I migrate its guest VMs (Jellyfin and a Docker host) to another cluster node, which doubles as a test of the disaster-recovery plan, fixing a couple of hardware incompatibilities along the way. The node then gets a fresh Proxmox 8 install rather than the in-place upgrade, which I document as a runbook covering non-subscription repositories, SSL certificates, Tailscale, and NFS storage...
