nuilab.org ↗

Docs / Tools & Frameworks / Tailscale

Tools & Frameworks

Tailscale

The private network the stack runs over — a WireGuard mesh that gives every machine a stable address and keeps the dashboards, broker, and bus off the public internet.

Updated Jun 26, 2026

tailscalenetworkingwireguardvpn

The whole stack assumes the machines can reach each other privately. Tailscale provides that with almost no setup: it builds a WireGuard mesh — a “tailnet” — across your machines, gives each a stable private address (for example 100.x.y.z), and connects them directly where it can. You install it, sign in on each machine, and they can talk.

It matters here for two reasons. First, it is what the dashboards, the broker , and the bus bind to, so none of them are exposed publicly — you reach a machine’s amux dashboard at its tailnet address, not over the open internet. Second, the address is stable and survives a machine moving networks, so the configs that point at it keep working.

Set it up

Install from tailscale.com/download , then on each machine:

tailscale up                 # sign in (opens a browser the first time)
tailscale ip -4              # the machine's tailnet address — use this in your binds

Enable MagicDNS in the admin console if you would rather use names than addresses.

For always-on machines

Tailscale node keys expire on a schedule by default, which eventually forces a re-login. For a machine that should stay connected unattended — a broker or an always-on agent host — turn off key expiry for that machine in the admin console, so it never drops off on its own.

Next

Source: content/tools/tailscale.md · maintained in the nuilab-agenticai repository.