Tailscale VPS

Who it suits

People who use Tailscale, or want the server reachable only over a private network: admin pages, databases and SSH without public ports. You need a Tailscale account; the server joins whichever tailnet you sign in with.

Which plan

Budget is enough for the client. Using the server as an exit node routes your devices' traffic through it, which counts against the plan's transfer.

What we install

The Tailscale client from Tailscale's own repository, started at boot. Run tailscale up once to add the server to your private network.

From order to ready

1. Server ready. We email you when the server is running, and you can log in with SSH. The installer starts on that same first boot.
2. Installer running. It logs to /var/log/vps9-setup.log; tail -f it to watch.
3. Application ready. This can be minutes after SSH works. The installer writes its exit code to /var/lib/vps9-setup.exit; a value of 0 means installation succeeded. The client is ready when tailscale status answers, saying it's logged out. Signing in is your step.

What you still do

1. Run tailscale up and open the login link it prints.
2. Optionally run tailscale up --ssh to manage the server over Tailscale SSH.

Exposure and security

The install opens no ports, and the server isn't on any tailnet until you run tailscale up. Nothing is configured as an exit node or subnet router; those are flags you add (--advertise-exit-node, --advertise-routes) and approve in Tailscale's admin console.

Backups and upgrades

Tailscale updates with the system's packages from its repository. Node keys expire according to your tailnet's settings; turn off key expiry for the server in the admin console if you don't want to sign it in again. We run the hardware, the network and the first-boot install; after that, Tailscale is yours to run, and we don't manage or update it for you. Off-site backups of the whole disk are an optional paid add-on; they copy the disk as it is at one moment, so keep the app's own backups as well.